diff options
| author | Lorenzo Bianconi | 2020-07-30 11:38:46 +0200 |
|---|---|---|
| committer | Felix Fietkau | 2020-09-24 18:10:13 +0200 |
| commit | 72372f3afc4a1ced5edabcec5c3c3f783ad9bc73 (patch) | |
| tree | b9ad24020c4140338cfb31a57f4b311deaff1b05 | |
| parent | 0825af2d3307f2e2930f1070c0128e2485732b80 (diff) | |
mt76: mt76s: fix oom in mt76s_tx_queue_skb_raw
Free the mcu skb in case of error in mt76s_tx_queue_skb_raw routine
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Signed-off-by: Felix Fietkau <nbd@nbd.name>
| -rw-r--r-- | drivers/net/wireless/mediatek/mt76/sdio.c | 13 |
1 files changed, 9 insertions, 4 deletions
diff --git a/drivers/net/wireless/mediatek/mt76/sdio.c b/drivers/net/wireless/mediatek/mt76/sdio.c index d2b38ed7f3b4..5d8353026aaf 100644 --- a/drivers/net/wireless/mediatek/mt76/sdio.c +++ b/drivers/net/wireless/mediatek/mt76/sdio.c @@ -244,22 +244,27 @@ mt76s_tx_queue_skb_raw(struct mt76_dev *dev, enum mt76_txq_id qid, struct mt76_queue *q = dev->q_tx[qid].q; int ret = -ENOSPC, len = skb->len; - spin_lock_bh(&q->lock); if (q->queued == q->ndesc) - goto out; + goto error; ret = mt76_skb_adjust_pad(skb); if (ret) - goto out; + goto error; + + spin_lock_bh(&q->lock); q->entry[q->tail].buf_sz = len; q->entry[q->tail].skb = skb; q->tail = (q->tail + 1) % q->ndesc; q->queued++; -out: spin_unlock_bh(&q->lock); + return 0; + +error: + dev_kfree_skb(skb); + return ret; } |