From 58ffa8d526e76d552a1fbc50197bdebc99f00564 Mon Sep 17 00:00:00 2001
From: Sylvain Rochet <gradator@gradator.net>
Date: Wed, 27 Feb 2013 22:29:22 +0100
Subject: [PATCH] PPP, free input pbuf left in ppp_delete()

---
 src/netif/ppp/ppp.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/src/netif/ppp/ppp.c b/src/netif/ppp/ppp.c
index 0038bc28..75216f81 100644
--- a/src/netif/ppp/ppp.c
+++ b/src/netif/ppp/ppp.c
@@ -613,6 +613,11 @@ int ppp_delete(ppp_pcb *pcb) {
   }
 #endif /* PPPOL2TP_SUPPORT */
 
+#if PPPOS_SUPPORT
+  /* input pbuf left ? */
+  ppp_free_current_input_packet(&pcb->rx);
+#endif /* PPPOS_SUPPORT */
+
   memp_free(MEMP_PPP_PCB, pcb);
   return 0;
 }
@@ -2020,6 +2025,9 @@ void ppp_link_terminated(ppp_pcb *pcb) {
 #endif /* PPPOL2TP_SUPPORT */
   {
 #if PPPOS_SUPPORT
+    /* We cannot call ppp_free_current_input_packet() here because
+     * rx thread might still call pppos_input_proc()
+     */
 #if PPP_INPROC_OWNTHREAD
     ppp_receive_wakeup(pcb);
 #endif /* PPP_INPROC_OWNTHREAD */