firewire: net: fix memory leaks

a) fwnet_transmit_packet_done used to poison ptask->pt_link by list_del.
If fwnet_send_packet checked later whether it was responsible to clean
up (in the border case that the TX soft IRQ was outpaced by the AT-req
tasklet on another CPU), it missed this because ptask->pt_link was no
longer shown as empty.

b) If fwnet_write_complete got an rcode other than RCODE_COMPLETE, we
missed to free the skb and ptask entirely.

Also, count stats.tx_dropped and stats.tx_errors when rcode != 0.

Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>

diff --git a/drivers/firewire/net.c b/drivers/firewire/net.c
index e2e968e732bc1553445482b5dcb767cc5ea7a2b5..3a27cee5bf26e26051c5f928bd4073c7dbc93aa7 100644 (file)
--- a/drivers/firewire/net.c
+++ b/drivers/firewire/net.c
@@ -916,9 +916,10 @@ static void fwnet_transmit_packet_done(struct fwnet_packet_task *ptask)
 
        /* Check whether we or the networking TX soft-IRQ is last user. */
        free = (ptask->outstanding_pkts == 0 && !list_empty(&ptask->pt_link));
+       if (free)
+               list_del(&ptask->pt_link);
 
        if (ptask->outstanding_pkts == 0) {
-               list_del(&ptask->pt_link);
                dev->netdev->stats.tx_packets++;
                dev->netdev->stats.tx_bytes += skb->len;
        }
@@ -973,6 +974,31 @@ static void fwnet_transmit_packet_done(struct fwnet_packet_task *ptask)
                fwnet_free_ptask(ptask);
 }
 
+static void fwnet_transmit_packet_failed(struct fwnet_packet_task *ptask)
+{
+       struct fwnet_device *dev = ptask->dev;
+       unsigned long flags;
+       bool free;
+
+       spin_lock_irqsave(&dev->lock, flags);
+
+       /* One fragment failed; don't try to send remaining fragments. */
+       ptask->outstanding_pkts = 0;
+
+       /* Check whether we or the networking TX soft-IRQ is last user. */
+       free = !list_empty(&ptask->pt_link);
+       if (free)
+               list_del(&ptask->pt_link);
+
+       dev->netdev->stats.tx_dropped++;
+       dev->netdev->stats.tx_errors++;
+
+       spin_unlock_irqrestore(&dev->lock, flags);
+
+       if (free)
+               fwnet_free_ptask(ptask);
+}
+
 static void fwnet_write_complete(struct fw_card *card, int rcode,
                                 void *payload, size_t length, void *data)
 {
@@ -980,11 +1006,12 @@ static void fwnet_write_complete(struct fw_card *card, int rcode,
 
        ptask = data;
 
-       if (rcode == RCODE_COMPLETE)
+       if (rcode == RCODE_COMPLETE) {
                fwnet_transmit_packet_done(ptask);
-       else
+       } else {
                fw_error("fwnet_write_complete: failed: %x\n", rcode);
-               /* ??? error recovery */
+               fwnet_transmit_packet_failed(ptask);
+       }
 }
 
 static int fwnet_send_packet(struct fwnet_packet_task *ptask)