mt76: fix handling full tx queues in mt76_dma_tx_queue_skb_raw
Fixes a theoretical issue where it could potentially overwrite an existing descriptor entry (and leaking its skb) Signed-off-by: Felix Fietkau <nbd@nbd.name>alistair/sensors
parent
5ffc6b5a98
commit
93eaec7625
|
@ -271,10 +271,13 @@ mt76_dma_tx_queue_skb_raw(struct mt76_dev *dev, enum mt76_txq_id qid,
|
|||
struct mt76_queue_buf buf;
|
||||
dma_addr_t addr;
|
||||
|
||||
if (q->queued + 1 >= q->ndesc - 1)
|
||||
goto error;
|
||||
|
||||
addr = dma_map_single(dev->dev, skb->data, skb->len,
|
||||
DMA_TO_DEVICE);
|
||||
if (unlikely(dma_mapping_error(dev->dev, addr)))
|
||||
return -ENOMEM;
|
||||
goto error;
|
||||
|
||||
buf.addr = addr;
|
||||
buf.len = skb->len;
|
||||
|
@ -285,6 +288,10 @@ mt76_dma_tx_queue_skb_raw(struct mt76_dev *dev, enum mt76_txq_id qid,
|
|||
spin_unlock_bh(&q->lock);
|
||||
|
||||
return 0;
|
||||
|
||||
error:
|
||||
dev_kfree_skb(skb);
|
||||
return -ENOMEM;
|
||||
}
|
||||
|
||||
static int
|
||||
|
|
Loading…
Reference in New Issue