mt76: mt76s: fix oom in mt76s_tx_queue_skb_raw
Free the mcu skb in case of error in mt76s_tx_queue_skb_raw routine Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> Signed-off-by: Felix Fietkau <nbd@nbd.name>
This commit is contained in:
parent
0825af2d33
commit
72372f3afc
|
@ -244,22 +244,27 @@ mt76s_tx_queue_skb_raw(struct mt76_dev *dev, enum mt76_txq_id qid,
|
||||||
struct mt76_queue *q = dev->q_tx[qid].q;
|
struct mt76_queue *q = dev->q_tx[qid].q;
|
||||||
int ret = -ENOSPC, len = skb->len;
|
int ret = -ENOSPC, len = skb->len;
|
||||||
|
|
||||||
spin_lock_bh(&q->lock);
|
|
||||||
if (q->queued == q->ndesc)
|
if (q->queued == q->ndesc)
|
||||||
goto out;
|
goto error;
|
||||||
|
|
||||||
ret = mt76_skb_adjust_pad(skb);
|
ret = mt76_skb_adjust_pad(skb);
|
||||||
if (ret)
|
if (ret)
|
||||||
goto out;
|
goto error;
|
||||||
|
|
||||||
|
spin_lock_bh(&q->lock);
|
||||||
|
|
||||||
q->entry[q->tail].buf_sz = len;
|
q->entry[q->tail].buf_sz = len;
|
||||||
q->entry[q->tail].skb = skb;
|
q->entry[q->tail].skb = skb;
|
||||||
q->tail = (q->tail + 1) % q->ndesc;
|
q->tail = (q->tail + 1) % q->ndesc;
|
||||||
q->queued++;
|
q->queued++;
|
||||||
|
|
||||||
out:
|
|
||||||
spin_unlock_bh(&q->lock);
|
spin_unlock_bh(&q->lock);
|
||||||
|
|
||||||
|
return 0;
|
||||||
|
|
||||||
|
error:
|
||||||
|
dev_kfree_skb(skb);
|
||||||
|
|
||||||
return ret;
|
return ret;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|
Loading…
Reference in New Issue