[PATCH] nfc: pn533: free queued command skbs during cleanup

[raoxu]

From: Xu Rao <raoxu@xxxxxxxxxxxxx>

pn53x_common_clean() destroys the workqueue and releases the common
PN533 state. It purges resp_q, but leaves fragment_skb untouched and
drops queued pn533_cmd objects without freeing their request skbs.

Queued commands are created by __pn533_send_async() when another command
is pending. At that point the queued command owns cmd->req until it is
sent or discarded. Fragmented transfers can also leave skbs queued in
fragment_skb.

Purge fragment_skb and free queued command request skbs before freeing
the command objects.

Signed-off-by: Xu Rao <raoxu@xxxxxxxxxxxxx>
---
 drivers/nfc/pn533/pn533.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/nfc/pn533/pn533.c b/drivers/nfc/pn533/pn533.c
index d7bdbc82e2ba..de2b7f4d708c 100644
--- a/drivers/nfc/pn533/pn533.c
+++ b/drivers/nfc/pn533/pn533.c
@@ -2799,9 +2799,11 @@ void pn53x_common_clean(struct pn533 *priv)
 	destroy_workqueue(priv->wq);

 	skb_queue_purge(&priv->resp_q);
+	skb_queue_purge(&priv->fragment_skb);

 	list_for_each_entry_safe(cmd, n, &priv->cmd_queue, queue) {
 		list_del(&cmd->queue);
+		dev_kfree_skb(cmd->req);
 		kfree(cmd);
 	}

--
2.50.1