In the implementation of mt7601u_mcu_msg_send(), skb is supposed to be
consumed on all execution paths. Release skb before returning if
test_bit() fails.

Signed-off-by: Navid Emamdoost <navid.emamdo...@gmail.com>
---
 drivers/net/wireless/mediatek/mt7601u/mcu.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/net/wireless/mediatek/mt7601u/mcu.c 
b/drivers/net/wireless/mediatek/mt7601u/mcu.c
index af55ed82b96f..1b5cc271a9e1 100644
--- a/drivers/net/wireless/mediatek/mt7601u/mcu.c
+++ b/drivers/net/wireless/mediatek/mt7601u/mcu.c
@@ -116,8 +116,10 @@ mt7601u_mcu_msg_send(struct mt7601u_dev *dev, struct 
sk_buff *skb,
        int sent, ret;
        u8 seq = 0;
 
-       if (test_bit(MT7601U_STATE_REMOVED, &dev->state))
+       if (test_bit(MT7601U_STATE_REMOVED, &dev->state)) {
+               consume_skb(skb);
                return 0;
+       }
 
        mutex_lock(&dev->mcu.mutex);
 
-- 
2.17.1

Reply via email to