mt76: fix handling full tx queues in mt76_dma_tx_queue_skb_raw

[ Upstream commit 93eaec7625f13cffb593b471405b017c7e64d4ee ]

Fixes a theoretical issue where it could potentially overwrite an existing
descriptor entry (and leaking its skb)

Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/drivers/net/wireless/mediatek/mt76/dma.c b/drivers/net/wireless/mediatek/mt76/dma.c
index 6249a46c197629c9cbf74a6580f155f952aecf20..026d996612fbef5986d70f114fa83365f25e2e61 100644 (file)
--- a/drivers/net/wireless/mediatek/mt76/dma.c
+++ b/drivers/net/wireless/mediatek/mt76/dma.c
@@ -261,10 +261,13 @@ mt76_dma_tx_queue_skb_raw(struct mt76_dev *dev, enum mt76_txq_id qid,
        struct mt76_queue_buf buf;
        dma_addr_t addr;
 
+       if (q->queued + 1 >= q->ndesc - 1)
+               goto error;
+
        addr = dma_map_single(dev->dev, skb->data, skb->len,
                              DMA_TO_DEVICE);
        if (unlikely(dma_mapping_error(dev->dev, addr)))
-               return -ENOMEM;
+               goto error;
 
        buf.addr = addr;
        buf.len = skb->len;
@@ -275,6 +278,10 @@ mt76_dma_tx_queue_skb_raw(struct mt76_dev *dev, enum mt76_txq_id qid,
        spin_unlock_bh(&q->lock);
 
        return 0;
+
+error:
+       dev_kfree_skb(skb);
+       return -ENOMEM;
 }
 
 static int