2020-07-30 09:41:20

by Lorenzo Bianconi

Subject: [PATCH] mt76: mt76s: fix oom in mt76s_tx_queue_skb_raw

Free the mcu skb in case of error in mt76s_tx_queue_skb_raw routine

Signed-off-by: Lorenzo Bianconi <[email protected]>
---
drivers/net/wireless/mediatek/mt76/sdio.c | 13 +++++++++----
1 file changed, 9 insertions(+), 4 deletions(-)

diff --git a/drivers/net/wireless/mediatek/mt76/sdio.c b/drivers/net/wireless/mediatek/mt76/sdio.c
index d2b38ed7f3b4..5d8353026aaf 100644
--- a/drivers/net/wireless/mediatek/mt76/sdio.c
+++ b/drivers/net/wireless/mediatek/mt76/sdio.c
@@ -244,22 +244,27 @@ mt76s_tx_queue_skb_raw(struct mt76_dev *dev, enum mt76_txq_id qid,
struct mt76_queue *q = dev->q_tx[qid].q;
int ret = -ENOSPC, len = skb->len;

- spin_lock_bh(&q->lock);
if (q->queued == q->ndesc)
- goto out;
+ goto error;

ret = mt76_skb_adjust_pad(skb);
if (ret)
- goto out;
+ goto error;
+
+ spin_lock_bh(&q->lock);

q->entry[q->tail].buf_sz = len;
q->entry[q->tail].skb = skb;
q->tail = (q->tail + 1) % q->ndesc;
q->queued++;

-out:
spin_unlock_bh(&q->lock);

+ return 0;
+
+error:
+ dev_kfree_skb(skb);
+
return ret;
}

--
2.26.2

2020-08-08 18:37:21

by Lorenzo Bianconi

Subject: Re: [PATCH] mt76: mt76s: fix oom in mt76s_tx_queue_skb_raw

>
> Free the mcu skb in case of error in mt76s_tx_queue_skb_raw routine
>
> Signed-off-by: Lorenzo Bianconi <[email protected]>
> ---

I think the proper fixes tag for this patch is:

Fixes: d39b52e31aa6 ("mt76: introduce mt76_sdio module")

Regards,
Lorenzo

> drivers/net/wireless/mediatek/mt76/sdio.c | 13 +++++++++----
> 1 file changed, 9 insertions(+), 4 deletions(-)
>
> diff --git a/drivers/net/wireless/mediatek/mt76/sdio.c b/drivers/net/wireless/mediatek/mt76/sdio.c
> index d2b38ed7f3b4..5d8353026aaf 100644
> --- a/drivers/net/wireless/mediatek/mt76/sdio.c
> +++ b/drivers/net/wireless/mediatek/mt76/sdio.c
> @@ -244,22 +244,27 @@ mt76s_tx_queue_skb_raw(struct mt76_dev *dev, enum mt76_txq_id qid,
> struct mt76_queue *q = dev->q_tx[qid].q;
> int ret = -ENOSPC, len = skb->len;
>
> - spin_lock_bh(&q->lock);
> if (q->queued == q->ndesc)
> - goto out;
> + goto error;
>
> ret = mt76_skb_adjust_pad(skb);
> if (ret)
> - goto out;
> + goto error;
> +
> + spin_lock_bh(&q->lock);
>
> q->entry[q->tail].buf_sz = len;
> q->entry[q->tail].skb = skb;
> q->tail = (q->tail + 1) % q->ndesc;
> q->queued++;
>
> -out:
> spin_unlock_bh(&q->lock);
>
> + return 0;
> +
> +error:
> + dev_kfree_skb(skb);
> +
> return ret;
> }
>
> --
> 2.26.2
>