From 72372f3afc4a1ced5edabcec5c3c3f783ad9bc73 Mon Sep 17 00:00:00 2001 From: Lorenzo Bianconi Date: Thu, 30 Jul 2020 11:38:46 +0200 Subject: mt76: mt76s: fix oom in mt76s_tx_queue_skb_raw Free the mcu skb in case of error in mt76s_tx_queue_skb_raw routine Signed-off-by: Lorenzo Bianconi Signed-off-by: Felix Fietkau --- drivers/net/wireless/mediatek/mt76/sdio.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) (limited to 'drivers/net/wireless/mediatek') diff --git a/drivers/net/wireless/mediatek/mt76/sdio.c b/drivers/net/wireless/mediatek/mt76/sdio.c index d2b38ed7f3b4..5d8353026aaf 100644 --- a/drivers/net/wireless/mediatek/mt76/sdio.c +++ b/drivers/net/wireless/mediatek/mt76/sdio.c @@ -244,22 +244,27 @@ mt76s_tx_queue_skb_raw(struct mt76_dev *dev, enum mt76_txq_id qid, struct mt76_queue *q = dev->q_tx[qid].q; int ret = -ENOSPC, len = skb->len; - spin_lock_bh(&q->lock); if (q->queued == q->ndesc) - goto out; + goto error; ret = mt76_skb_adjust_pad(skb); if (ret) - goto out; + goto error; + + spin_lock_bh(&q->lock); q->entry[q->tail].buf_sz = len; q->entry[q->tail].skb = skb; q->tail = (q->tail + 1) % q->ndesc; q->queued++; -out: spin_unlock_bh(&q->lock); + return 0; + +error: + dev_kfree_skb(skb); + return ret; } -- cgit v1.2.3