[PATCH ath-next] wifi: ath9k: free clone buffer on fi->bf overwrite in ath_tx_setup_buffer

[Rosen Penev]

ath_clone_txbuf allocates an ath_buf for the last stale subframe of an
A-MPDU and stores it in fi->bf. On retransmission, ath_tx_setup_buffer
overwrites fi->bf with the newly allocated buffer without freeing the
clone, leaking one ath_buf per aggregate retry that enters the clone
path.

Clear the clone's references and return it to the free pool before
overwriting fi->bf.

Assisted-by: opencode:big-pickle
Signed-off-by: Rosen Penev <rosenp@xxxxxxxxx>
---
 drivers/net/wireless/ath/ath9k/xmit.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/net/wireless/ath/ath9k/xmit.c b/drivers/net/wireless/ath/ath9k/xmit.c
index 89930eaf1fd3..b12eb878d5e7 100644
--- a/drivers/net/wireless/ath/ath9k/xmit.c
+++ b/drivers/net/wireless/ath/ath9k/xmit.c
@@ -2264,6 +2264,11 @@ static struct ath_buf *ath_tx_setup_buffer(struct ath_softc *sc,
 		return NULL;
 	}
 
+	if (fi->bf) {
+		fi->bf->bf_mpdu = NULL;
+		fi->bf->bf_buf_addr = 0;
+		ath_tx_return_buffer(sc, fi->bf);
+	}
 	fi->bf = bf;
 
 	return bf;
-- 
2.55.0