The return value of dma_map_single() should be checked for errors using
dma_mapping_error() and the skb has been dequeued so it needs to be
freed.

Fixes: 1807da49733e ("ath10k: wmi: add management tx by reference support over 
wmi")
Reported-by: Niklas Cassel <niklas.cas...@linaro.org>
Signed-off-by: Bjorn Andersson <bjorn.anders...@linaro.org>
---

Changes since v1:
- Free the dequeued skb

 drivers/net/wireless/ath/ath10k/mac.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/net/wireless/ath/ath10k/mac.c 
b/drivers/net/wireless/ath/ath10k/mac.c
index 3d2c8fcba952..e8bdb2ba9b18 100644
--- a/drivers/net/wireless/ath/ath10k/mac.c
+++ b/drivers/net/wireless/ath/ath10k/mac.c
@@ -3904,8 +3904,10 @@ void ath10k_mgmt_over_wmi_tx_work(struct work_struct 
*work)
                             ar->running_fw->fw_file.fw_features)) {
                        paddr = dma_map_single(ar->dev, skb->data,
                                               skb->len, DMA_TO_DEVICE);
-                       if (!paddr)
+                       if (dma_mapping_error(ar->dev, paddr)) {
+                               ieee80211_free_txskb(ar->hw, skb);
                                continue;
+                       }
                        ret = ath10k_wmi_mgmt_tx_send(ar, skb, paddr);
                        if (ret) {
                                ath10k_warn(ar, "failed to transmit management 
frame by ref via WMI: %d\n",
-- 
2.23.0

Reply via email to