Received-SPF: pass (google.com: domain of linux-wireless-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
MIME-Version: 1.0
References: <368c78ef79cb6782008b33a87d73b5fc51ba2989.1596101881.git.lorenzo@kernel.org>
In-Reply-To: <368c78ef79cb6782008b33a87d73b5fc51ba2989.1596101881.git.lorenzo@kernel.org>
From:   Lorenzo Bianconi <lorenzo.bianconi@redhat.com>
Date:   Sat, 8 Aug 2020 20:34:37 +0200
Message-ID: <CAJ0CqmVXrfMJXWnW+cZCFJxv1+At4UrPesrvk0D73iHTaFgFyA@mail.gmail.com>
Subject: Re: [PATCH] mt76: mt76s: fix oom in mt76s_tx_queue_skb_raw
To:     Lorenzo Bianconi <lorenzo@kernel.org>
Cc:     Felix Fietkau <nbd@nbd.name>, Sean Wang <sean.wang@mediatek.com>,
        linux-wireless <linux-wireless@vger.kernel.org>
Content-Type: text/plain; charset="UTF-8"
Sender: linux-wireless-owner@vger.kernel.org
Precedence: bulk

>
> Free the mcu skb in case of error in mt76s_tx_queue_skb_raw routine
>
> Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
> ---

I think the proper fixes tag for this patch is:

Fixes: d39b52e31aa6 ("mt76: introduce mt76_sdio module")

Regards,
Lorenzo

>  drivers/net/wireless/mediatek/mt76/sdio.c | 13 +++++++++----
>  1 file changed, 9 insertions(+), 4 deletions(-)
>
> diff --git a/drivers/net/wireless/mediatek/mt76/sdio.c b/drivers/net/wireless/mediatek/mt76/sdio.c
> index d2b38ed7f3b4..5d8353026aaf 100644
> --- a/drivers/net/wireless/mediatek/mt76/sdio.c
> +++ b/drivers/net/wireless/mediatek/mt76/sdio.c
> @@ -244,22 +244,27 @@ mt76s_tx_queue_skb_raw(struct mt76_dev *dev, enum mt76_txq_id qid,
>         struct mt76_queue *q = dev->q_tx[qid].q;
>         int ret = -ENOSPC, len = skb->len;
>
> -       spin_lock_bh(&q->lock);
>         if (q->queued == q->ndesc)
> -               goto out;
> +               goto error;
>
>         ret = mt76_skb_adjust_pad(skb);
>         if (ret)
> -               goto out;
> +               goto error;
> +
> +       spin_lock_bh(&q->lock);
>
>         q->entry[q->tail].buf_sz = len;
>         q->entry[q->tail].skb = skb;
>         q->tail = (q->tail + 1) % q->ndesc;
>         q->queued++;
>
> -out:
>         spin_unlock_bh(&q->lock);
>
> +       return 0;
> +
> +error:
> +       dev_kfree_skb(skb);
> +
>         return ret;
>  }
>
> --
> 2.26.2
>