mt76: fix handling full tx queues in mt76_dma_tx_queue_skb_raw
[ Upstream commit 93eaec7625
]
Fixes a theoretical issue where it could potentially overwrite an existing
descriptor entry (and leaking its skb)
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Sasha Levin <sashal@kernel.org>
5.4-rM2-2.2.x-imx-squashed
parent
9b42bfb06d
commit
78344a4dc4
|
@ -261,10 +261,13 @@ mt76_dma_tx_queue_skb_raw(struct mt76_dev *dev, enum mt76_txq_id qid,
|
||||||
struct mt76_queue_buf buf;
|
struct mt76_queue_buf buf;
|
||||||
dma_addr_t addr;
|
dma_addr_t addr;
|
||||||
|
|
||||||
|
if (q->queued + 1 >= q->ndesc - 1)
|
||||||
|
goto error;
|
||||||
|
|
||||||
addr = dma_map_single(dev->dev, skb->data, skb->len,
|
addr = dma_map_single(dev->dev, skb->data, skb->len,
|
||||||
DMA_TO_DEVICE);
|
DMA_TO_DEVICE);
|
||||||
if (unlikely(dma_mapping_error(dev->dev, addr)))
|
if (unlikely(dma_mapping_error(dev->dev, addr)))
|
||||||
return -ENOMEM;
|
goto error;
|
||||||
|
|
||||||
buf.addr = addr;
|
buf.addr = addr;
|
||||||
buf.len = skb->len;
|
buf.len = skb->len;
|
||||||
|
@ -275,6 +278,10 @@ mt76_dma_tx_queue_skb_raw(struct mt76_dev *dev, enum mt76_txq_id qid,
|
||||||
spin_unlock_bh(&q->lock);
|
spin_unlock_bh(&q->lock);
|
||||||
|
|
||||||
return 0;
|
return 0;
|
||||||
|
|
||||||
|
error:
|
||||||
|
dev_kfree_skb(skb);
|
||||||
|
return -ENOMEM;
|
||||||
}
|
}
|
||||||
|
|
||||||
static int
|
static int
|
||||||
|
|
Loading…
Reference in New Issue