[PATCH AUTOSEL 5.4 130/330] mt76: fix handling full tx queues in mt76_dma_tx_queue_skb_raw

[Sasha Levin]

From: Felix Fietkau <n...@nbd.name>

[ Upstream commit 93eaec7625f13cffb593b471405b017c7e64d4ee ]

Fixes a theoretical issue where it could potentially overwrite an existing
descriptor entry (and leaking its skb)

Signed-off-by: Felix Fietkau <n...@nbd.name>
Signed-off-by: Sasha Levin <sas...@kernel.org>
---
 drivers/net/wireless/mediatek/mt76/dma.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/drivers/net/wireless/mediatek/mt76/dma.c 
b/drivers/net/wireless/mediatek/mt76/dma.c
index 6249a46c19762..026d996612fbe 100644
--- a/drivers/net/wireless/mediatek/mt76/dma.c
+++ b/drivers/net/wireless/mediatek/mt76/dma.c
@@ -261,10 +261,13 @@ mt76_dma_tx_queue_skb_raw(struct mt76_dev *dev, enum 
mt76_txq_id qid,
        struct mt76_queue_buf buf;
        dma_addr_t addr;
 
+       if (q->queued + 1 >= q->ndesc - 1)
+               goto error;
+
        addr = dma_map_single(dev->dev, skb->data, skb->len,
                              DMA_TO_DEVICE);
        if (unlikely(dma_mapping_error(dev->dev, addr)))
-               return -ENOMEM;
+               goto error;
 
        buf.addr = addr;
        buf.len = skb->len;
@@ -275,6 +278,10 @@ mt76_dma_tx_queue_skb_raw(struct mt76_dev *dev, enum 
mt76_txq_id qid,
        spin_unlock_bh(&q->lock);
 
        return 0;
+
+error:
+       dev_kfree_skb(skb);
+       return -ENOMEM;
 }
 
 static int
-- 
2.25.1