2020-07-18 05:48:11

by Navid Emamdoost

Subject: [PATCH] mt76: mt76u: add missing release on skb in __mt76x02u_mcu_send_msg

In the implementation of __mt76x02u_mcu_send_msg() the skb is consumed
all execution paths except one. Release skb before returning if
test_bit() fails.

Signed-off-by: Navid Emamdoost <[email protected]>
---
drivers/net/wireless/mediatek/mt76/mt76x02_usb_mcu.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/drivers/net/wireless/mediatek/mt76/mt76x02_usb_mcu.c b/drivers/net/wireless/mediatek/mt76/mt76x02_usb_mcu.c
index a30bb536fc8a..e43d13d7c988 100644
--- a/drivers/net/wireless/mediatek/mt76/mt76x02_usb_mcu.c
+++ b/drivers/net/wireless/mediatek/mt76/mt76x02_usb_mcu.c
@@ -87,8 +87,10 @@ __mt76x02u_mcu_send_msg(struct mt76_dev *dev, struct sk_buff *skb,
u32 info;
int ret;

- if (test_bit(MT76_REMOVED, &dev->phy.state))
- return 0;
+ if (test_bit(MT76_REMOVED, &dev->phy.state)) {
+ ret = 0;
+ goto out;
+ }

if (wait_resp) {
seq = ++dev->mcu.msg_seq & 0xf;
@@ -111,6 +113,7 @@ __mt76x02u_mcu_send_msg(struct mt76_dev *dev, struct sk_buff *skb,
if (wait_resp)
ret = mt76x02u_mcu_wait_resp(dev, seq);

+out:
consume_skb(skb);

return ret;
--
2.17.1

2020-07-18 15:21:17

by Markus Elfring

Subject: Re: [PATCH] mt76: mt76u: add missing release on skb in __mt76x02u_mcu_send_msg

…
> +++ b/drivers/net/wireless/mediatek/mt76/mt76x02_usb_mcu.c
…
> @@ -111,6 +113,7 @@ __mt76x02u_mcu_send_msg(struct mt76_dev *dev, struct sk_buff *skb,
> if (wait_resp)
> ret = mt76x02u_mcu_wait_resp(dev, seq);
>
> +out:
> consume_skb(skb);
…

I suggest to use the label “consume_skb”.

Would you like to add the tag “Fixes” to the commit message?

Regards,
Markus