From 689de38e37179c6f524dd003e1dae92042f8f5cd Mon Sep 17 00:00:00 2001 From: Rajkumar Manoharan Date: Thu, 7 Apr 2016 12:07:31 +0530 Subject: [PATCH] ath10k: fix unconditional num_mpdus_ready subtraction Decrement num_mpdus_ready only when rx amsdu is processed successfully. Not doing so, will result in leak and impact stabilty under low memory cases. Also commit 3128b3d8a2b9 ("ath10k: speedup htt rx descriptor processing for rx_ind") missed to removed unused skb list rx_q. Fixes: 3128b3d8a2b9 ("ath10k: speedup htt rx descriptor processing for rx_ind") Signed-off-by: Rajkumar Manoharan Signed-off-by: Kalle Valo --- drivers/net/wireless/ath/ath10k/htt_rx.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/drivers/net/wireless/ath/ath10k/htt_rx.c b/drivers/net/wireless/ath/ath10k/htt_rx.c index 592421ec5635..6a2d2643de42 100644 --- a/drivers/net/wireless/ath/ath10k/htt_rx.c +++ b/drivers/net/wireless/ath/ath10k/htt_rx.c @@ -2412,14 +2412,12 @@ static void ath10k_htt_txrx_compl_task(unsigned long ptr) struct ath10k_htt *htt = (struct ath10k_htt *)ptr; struct ath10k *ar = htt->ar; struct htt_tx_done tx_done = {}; - struct sk_buff_head rx_q; struct sk_buff_head rx_ind_q; struct sk_buff_head tx_ind_q; struct sk_buff *skb; unsigned long flags; int num_mpdus; - __skb_queue_head_init(&rx_q); __skb_queue_head_init(&rx_ind_q); __skb_queue_head_init(&tx_ind_q); @@ -2447,11 +2445,13 @@ static void ath10k_htt_txrx_compl_task(unsigned long ptr) ath10k_mac_tx_push_pending(ar); num_mpdus = atomic_read(&htt->num_mpdus_ready); - atomic_sub(num_mpdus, &htt->num_mpdus_ready); - while (num_mpdus--) { + while (num_mpdus) { if (ath10k_htt_rx_handle_amsdu(htt)) break; + + num_mpdus--; + atomic_dec(&htt->num_mpdus_ready); } while ((skb = __skb_dequeue(&rx_ind_q))) {