Re: [PATCH ath-next] wifi: ath9k: free clone buffer on fi->bf overwrite in ath_tx_setup_buffer

[Toke Høiland-Jørgensen]

Rosen Penev <rosenp@xxxxxxxxx> writes:

> ath_clone_txbuf allocates an ath_buf for the last stale subframe of an
> A-MPDU and stores it in fi->bf. On retransmission, ath_tx_setup_buffer
> overwrites fi->bf with the newly allocated buffer without freeing the
> clone, leaking one ath_buf per aggregate retry that enters the clone
> path.

Huh? No, it doesn't - ath_tx_get_tid_subframe() has this:

		if (!fi->bf)
			bf = ath_tx_setup_buffer(sc, txq, tid, skb);
		else
			bf->bf_state.stale = false;

-Toke