ath_clone_txbuf allocates an ath_buf for the last stale subframe of an
A-MPDU and stores it in fi->bf. On retransmission, ath_tx_setup_buffer
overwrites fi->bf with the newly allocated buffer without freeing the
clone, leaking one ath_buf per aggregate retry that enters the clone
path.

Clear the clone's references and return it to the free pool before
overwriting fi->bf.

Assisted-by: opencode:big-pickle
Signed-off-by: Rosen Penev <rosenp@gmail.com>
---
 drivers/net/wireless/ath/ath9k/xmit.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/net/wireless/ath/ath9k/xmit.c b/drivers/net/wireless/ath/ath9k/xmit.c
index 89930eaf1fd3..b12eb878d5e7 100644
--- a/drivers/net/wireless/ath/ath9k/xmit.c
+++ b/drivers/net/wireless/ath/ath9k/xmit.c
@@ -2264,6 +2264,11 @@ static struct ath_buf *ath_tx_setup_buffer(struct ath_softc *sc,
 		return NULL;
 	}
 
+	if (fi->bf) {
+		fi->bf->bf_mpdu = NULL;
+		fi->bf->bf_buf_addr = 0;
+		ath_tx_return_buffer(sc, fi->bf);
+	}
 	fi->bf = bf;
 
 	return bf;
-- 
2.55.0

Rosen Penev <rosenp@gmail.com> writes:

> ath_clone_txbuf allocates an ath_buf for the last stale subframe of an
> A-MPDU and stores it in fi->bf. On retransmission, ath_tx_setup_buffer
> overwrites fi->bf with the newly allocated buffer without freeing the
> clone, leaking one ath_buf per aggregate retry that enters the clone
> path.

Huh? No, it doesn't - ath_tx_get_tid_subframe() has this:

		if (!fi->bf)
			bf = ath_tx_setup_buffer(sc, txq, tid, skb);
		else
			bf->bf_state.stale = false;

-Toke