Commit 93eaec76 authored by Felix Fietkau's avatar Felix Fietkau
Browse files

mt76: fix handling full tx queues in mt76_dma_tx_queue_skb_raw



Fixes a theoretical issue where it could potentially overwrite an existing
descriptor entry (and leaking its skb)

Signed-off-by: default avatarFelix Fietkau <nbd@nbd.name>
parent 5ffc6b5a
Loading
Loading
Loading
Loading
+8 −1
Original line number Diff line number Diff line
@@ -271,10 +271,13 @@ mt76_dma_tx_queue_skb_raw(struct mt76_dev *dev, enum mt76_txq_id qid,
	struct mt76_queue_buf buf;
	dma_addr_t addr;

	if (q->queued + 1 >= q->ndesc - 1)
		goto error;

	addr = dma_map_single(dev->dev, skb->data, skb->len,
			      DMA_TO_DEVICE);
	if (unlikely(dma_mapping_error(dev->dev, addr)))
		return -ENOMEM;
		goto error;

	buf.addr = addr;
	buf.len = skb->len;
@@ -285,6 +288,10 @@ mt76_dma_tx_queue_skb_raw(struct mt76_dev *dev, enum mt76_txq_id qid,
	spin_unlock_bh(&q->lock);

	return 0;

error:
	dev_kfree_skb(skb);
	return -ENOMEM;
}

static int