[src/netbsd-9]: src/sys/dev/usb Pull up following revision(s) (requested by n...

[martin <martin%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/be7c97dc14da
branches:  netbsd-9
changeset: 953869:be7c97dc14da
user:      martin <martin%NetBSD.org@localhost>
date:      Mon Mar 22 18:20:38 2021 +0000

description:
Pull up following revision(s) (requested by nat in ticket #1234),
all via patch:

        sys/dev/usb/if_urtwn.c: revision 1.93
        sys/dev/usb/if_urtwn.c: revision 1.95
        sys/dev/usb/if_urtwn.c: revision 1.96

if_urtwn.c: Plug a few leaks
Can be a cause of PR/55968

Also free assocated mbufs.

Opps....Remove irrelavent debug code and don't free_m before IFQ_DEQUEUE().
Identified and reported by Patrick Welche and remedy found by Martin Husemann.

diffstat:

 sys/dev/usb/if_urtwn.c |  32 ++++++++++++++++++++++++--------
 1 files changed, 24 insertions(+), 8 deletions(-)

diffs (89 lines):

diff -r 2446602a215e -r be7c97dc14da sys/dev/usb/if_urtwn.c
--- a/sys/dev/usb/if_urtwn.c    Mon Mar 22 18:06:17 2021 +0000
+++ b/sys/dev/usb/if_urtwn.c    Mon Mar 22 18:20:38 2021 +0000
@@ -1,4 +1,4 @@
-/*     $NetBSD: if_urtwn.c,v 1.71.2.4 2021/02/04 19:23:10 martin Exp $ */
+/*     $NetBSD: if_urtwn.c,v 1.71.2.5 2021/03/22 18:20:38 martin Exp $ */
 /*     $OpenBSD: if_urtwn.c,v 1.42 2015/02/10 23:25:46 mpi Exp $       */
 
 /*-
@@ -25,7 +25,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: if_urtwn.c,v 1.71.2.4 2021/02/04 19:23:10 martin Exp $");
+__KERNEL_RCSID(0, "$NetBSD: if_urtwn.c,v 1.71.2.5 2021/03/22 18:20:38 martin Exp $");
 
 #ifdef _KERNEL_OPT
 #include "opt_inet.h"
@@ -2563,6 +2563,17 @@
 }
 
 static void
+urtwn_put_tx_data(struct urtwn_softc *sc, struct urtwn_tx_data *data)
+{
+       size_t pidx = data->pidx;
+
+       mutex_enter(&sc->sc_tx_mtx);
+       /* Put this Tx buffer back to our free list. */
+       TAILQ_INSERT_TAIL(&sc->tx_free_list[pidx], data, next);
+       mutex_exit(&sc->sc_tx_mtx);
+}
+
+static void
 urtwn_txeof(struct usbd_xfer *xfer, void *priv, usbd_status status)
 {
        struct urtwn_tx_data *data = priv;
@@ -2574,10 +2585,7 @@
        DPRINTFN(DBG_FN|DBG_TX, ("%s: %s: status=%d\n",
            device_xname(sc->sc_dev), __func__, status));
 
-       mutex_enter(&sc->sc_tx_mtx);
-       /* Put this Tx buffer back to our free list. */
-       TAILQ_INSERT_TAIL(&sc->tx_free_list[pidx], data, next);
-       mutex_exit(&sc->sc_tx_mtx);
+       urtwn_put_tx_data(sc, data);
 
        s = splnet();
        sc->tx_timer = 0;
@@ -2626,8 +2634,11 @@
 
        if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
                k = ieee80211_crypto_encap(ic, ni, m);
-               if (k == NULL)
+               if (k == NULL) {
+                       urtwn_put_tx_data(sc, data);
+                       m_free(m);
                        return ENOBUFS;
+               }
 
                /* packet header may have moved, reset our local pointer */
                wh = mtod(m, struct ieee80211_frame *);
@@ -2890,14 +2901,17 @@
                    (m = m_pullup(m, sizeof(*eh))) == NULL) {
                        printf("ERROR6\n");
                        ifp->if_oerrors++;
+                       urtwn_put_tx_data(sc, data);
+                       m_freem(m);
                        continue;
                }
                eh = mtod(m, struct ether_header *);
                ni = ieee80211_find_txnode(ic, eh->ether_dhost);
                if (ni == NULL) {
-                       m_freem(m);
                        printf("ERROR5\n");
                        ifp->if_oerrors++;
+                       urtwn_put_tx_data(sc, data);
+                       m_freem(m);
                        continue;
                }
 
@@ -2907,6 +2921,8 @@
                        ieee80211_free_node(ni);
                        printf("ERROR4\n");
                        ifp->if_oerrors++;
+                       urtwn_put_tx_data(sc, data);
+                       m_freem(m);
                        continue;
                }
  sendit: