ath10k_htt_tx_hl() takes an extra reference on the msdu with skb_get(), which is normally dropped by ath10k_htt_htc_tx_complete(). When ath10k_htc_send_hl() fails it does not free the skb and no completion runs, so that reference is never released. Drop the reference on the error path. Fixes: c8334512f3dd ("ath10k: add htt TX bundle for sdio") Cc: stable@vger.kernel.org Signed-off-by: Wentao Liang --- drivers/net/wireless/ath/ath10k/htt_tx.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/net/wireless/ath/ath10k/htt_tx.c b/drivers/net/wireless/ath/ath10k/htt_tx.c index d6f1d85ba871..24617d610297 100644 --- a/drivers/net/wireless/ath/ath10k/htt_tx.c +++ b/drivers/net/wireless/ath/ath10k/htt_tx.c @@ -1377,6 +1377,8 @@ static int ath10k_htt_tx_hl(struct ath10k_htt *htt, enum ath10k_hw_txrx_mode txm tx_desc->peerid = __cpu_to_le32(HTT_INVALID_PEERID); res = ath10k_htc_send_hl(&htt->ar->htc, htt->eid, msdu); + if (res) + dev_kfree_skb_any(msdu); out: return res; -- 2.34.1