lkml.org 
[lkml]   [2020]   [Sep]   [17]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH AUTOSEL 5.4 130/330] mt76: fix handling full tx queues in mt76_dma_tx_queue_skb_raw
    Date
    From: Felix Fietkau <nbd@nbd.name>

    [ Upstream commit 93eaec7625f13cffb593b471405b017c7e64d4ee ]

    Fixes a theoretical issue where it could potentially overwrite an existing
    descriptor entry (and leaking its skb)

    Signed-off-by: Felix Fietkau <nbd@nbd.name>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/net/wireless/mediatek/mt76/dma.c | 9 ++++++++-
    1 file changed, 8 insertions(+), 1 deletion(-)

    diff --git a/drivers/net/wireless/mediatek/mt76/dma.c b/drivers/net/wireless/mediatek/mt76/dma.c
    index 6249a46c19762..026d996612fbe 100644
    --- a/drivers/net/wireless/mediatek/mt76/dma.c
    +++ b/drivers/net/wireless/mediatek/mt76/dma.c
    @@ -261,10 +261,13 @@ mt76_dma_tx_queue_skb_raw(struct mt76_dev *dev, enum mt76_txq_id qid,
    struct mt76_queue_buf buf;
    dma_addr_t addr;

    + if (q->queued + 1 >= q->ndesc - 1)
    + goto error;
    +
    addr = dma_map_single(dev->dev, skb->data, skb->len,
    DMA_TO_DEVICE);
    if (unlikely(dma_mapping_error(dev->dev, addr)))
    - return -ENOMEM;
    + goto error;

    buf.addr = addr;
    buf.len = skb->len;
    @@ -275,6 +278,10 @@ mt76_dma_tx_queue_skb_raw(struct mt76_dev *dev, enum mt76_txq_id qid,
    spin_unlock_bh(&q->lock);

    return 0;
    +
    +error:
    + dev_kfree_skb(skb);
    + return -ENOMEM;
    }

    static int
    --
    2.25.1
    \
     
     \ /
      Last update: 2020-09-18 05:08    [W:4.076 / U:0.156 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site