diff options
| author | Felix Fietkau <nbd@nbd.name> | 2020-01-20 12:08:30 +0100 |
|---|---|---|
| committer | Felix Fietkau <nbd@nbd.name> | 2020-02-14 10:06:06 +0100 |
| commit | 93eaec7625f13cffb593b471405b017c7e64d4ee (patch) | |
| tree | b2e3763cea0bcf613178696c0f6240136ed1677d /drivers/net/wireless/mediatek/mt76/dma.c | |
| parent | 5ffc6b5a98404db51529c427ccbccd4878593cea (diff) | |
mt76: fix handling full tx queues in mt76_dma_tx_queue_skb_raw
Fixes a theoretical issue where it could potentially overwrite an existing
descriptor entry (and leaking its skb)
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Diffstat (limited to 'drivers/net/wireless/mediatek/mt76/dma.c')
| -rw-r--r-- | drivers/net/wireless/mediatek/mt76/dma.c | 9 |
1 files changed, 8 insertions, 1 deletions
diff --git a/drivers/net/wireless/mediatek/mt76/dma.c b/drivers/net/wireless/mediatek/mt76/dma.c index e69329feed78..bcb11bb9aeeb 100644 --- a/drivers/net/wireless/mediatek/mt76/dma.c +++ b/drivers/net/wireless/mediatek/mt76/dma.c @@ -271,10 +271,13 @@ mt76_dma_tx_queue_skb_raw(struct mt76_dev *dev, enum mt76_txq_id qid, struct mt76_queue_buf buf; dma_addr_t addr; + if (q->queued + 1 >= q->ndesc - 1) + goto error; + addr = dma_map_single(dev->dev, skb->data, skb->len, DMA_TO_DEVICE); if (unlikely(dma_mapping_error(dev->dev, addr))) - return -ENOMEM; + goto error; buf.addr = addr; buf.len = skb->len; @@ -285,6 +288,10 @@ mt76_dma_tx_queue_skb_raw(struct mt76_dev *dev, enum mt76_txq_id qid, spin_unlock_bh(&q->lock); return 0; + +error: + dev_kfree_skb(skb); + return -ENOMEM; } static int |