| Message ID | a560caffcc24452fb48af53904bbe5c45ea5db93.1637602268.git.lorenzo@kernel.org (mailing list archive) |
|---|---|
| State | Accepted |
| Commit | 2a9e9857473bfc5721092ff274bc1e371e5a0d2f |
| Delegated to: | Kalle Valo |
| Headers | show |
| Series | [wireless-drivers] mt76: fix possible pktid leak | expand |
Lorenzo Bianconi <lorenzo@kernel.org> writes: > Fix a possible idr pkt-id leak if the packet is dropped on tx side > > Fixes: bd1e3e7b693c ("mt76: introduce packet_id idr") > Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> I can take this to wireless-drivers and the patch is already assigned to me. Felix, ack?
On 2021-11-24 09:07, Kalle Valo wrote: > Lorenzo Bianconi <lorenzo@kernel.org> writes: > >> Fix a possible idr pkt-id leak if the packet is dropped on tx side >> >> Fixes: bd1e3e7b693c ("mt76: introduce packet_id idr") >> Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> > > I can take this to wireless-drivers and the patch is already assigned to > me. Felix, ack? Acked-by: Felix Fietkau <nbd@nbd.name>
Lorenzo Bianconi <lorenzo@kernel.org> wrote: > Fix a possible idr pkt-id leak if the packet is dropped on tx side > > Fixes: bd1e3e7b693c ("mt76: introduce packet_id idr") > Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> > Acked-by: Felix Fietkau <nbd@nbd.name> Patch applied to wireless-drivers.git, thanks. 2a9e9857473b mt76: fix possible pktid leak
> Lorenzo Bianconi <lorenzo@kernel.org> wrote: > > > Fix a possible idr pkt-id leak if the packet is dropped on tx side > > > > Fixes: bd1e3e7b693c ("mt76: introduce packet_id idr") > > Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> > > Acked-by: Felix Fietkau <nbd@nbd.name> > > Patch applied to wireless-drivers.git, thanks. > > 2a9e9857473b mt76: fix possible pktid leak Hi Kalle, Unfortunately I found a regression introduced by this patch for mt7663u (and I guess for mt7921s as well). Do you want me to post a fix or just a v2? Sorry for the noise. @Sean: can you please test the following patch on mt7921s? (I do not have the hw). Regards, Lorenzo diff --git a/drivers/net/wireless/mediatek/mt76/mt7615/usb_sdio.c b/drivers/net/wireless/mediatek/mt76/mt7615/usb_sdio.c index bfe6c1579dc1..c51c1d82083e 100644 --- a/drivers/net/wireless/mediatek/mt76/mt7615/usb_sdio.c +++ b/drivers/net/wireless/mediatek/mt76/mt7615/usb_sdio.c @@ -43,10 +43,9 @@ EXPORT_SYMBOL_GPL(mt7663_usb_sdio_reg_map); static void mt7663_usb_sdio_write_txwi(struct mt7615_dev *dev, struct mt76_wcid *wcid, enum mt76_txq_id qid, struct ieee80211_sta *sta, - int pid, struct sk_buff *skb) + struct ieee80211_key_conf *key, int pid, + struct sk_buff *skb) { - struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb); - struct ieee80211_key_conf *key = info->control.hw_key; __le32 *txwi; txwi = (__le32 *)(skb->data - MT_USB_TXD_SIZE); @@ -188,6 +187,7 @@ int mt7663_usb_sdio_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr, struct mt7615_dev *dev = container_of(mdev, struct mt7615_dev, mt76); struct sk_buff *skb = tx_info->skb; struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb); + struct ieee80211_key_conf *key = info->control.hw_key; struct mt7615_sta *msta; int pad, err, pktid; @@ -205,7 +205,7 @@ int mt7663_usb_sdio_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr, } pktid = mt76_tx_status_skb_add(&dev->mt76, wcid, skb); - mt7663_usb_sdio_write_txwi(dev, wcid, qid, sta, pktid, skb); + mt7663_usb_sdio_write_txwi(dev, wcid, qid, sta, key, pktid, skb); if (mt76_is_usb(mdev)) { u32 len = skb->len; diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/sdio_mac.c b/drivers/net/wireless/mediatek/mt76/mt7921/sdio_mac.c index 85b3d88f8ecc..c7d54e5c8392 100644 --- a/drivers/net/wireless/mediatek/mt76/mt7921/sdio_mac.c +++ b/drivers/net/wireless/mediatek/mt76/mt7921/sdio_mac.c @@ -142,10 +142,9 @@ int mt7921s_mac_reset(struct mt7921_dev *dev) static void mt7921s_write_txwi(struct mt7921_dev *dev, struct mt76_wcid *wcid, enum mt76_txq_id qid, struct ieee80211_sta *sta, - int pid, struct sk_buff *skb) + struct ieee80211_key_conf *key, int pid, + struct sk_buff *skb) { - struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb); - struct ieee80211_key_conf *key = info->control.hw_key; __le32 *txwi; txwi = (__le32 *)(skb->data - MT_SDIO_TXD_SIZE); @@ -161,6 +160,7 @@ int mt7921s_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr, { struct mt7921_dev *dev = container_of(mdev, struct mt7921_dev, mt76); struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx_info->skb); + struct ieee80211_key_conf *key = info->control.hw_key; struct sk_buff *skb = tx_info->skb; int err, pad, pktid; @@ -180,7 +180,7 @@ int mt7921s_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr, } pktid = mt76_tx_status_skb_add(&dev->mt76, wcid, skb); - mt7921s_write_txwi(dev, wcid, qid, sta, pktid, skb); + mt7921s_write_txwi(dev, wcid, qid, sta, key, pktid, skb); mt7921_skb_add_sdio_hdr(skb, MT7921_SDIO_DATA); pad = round_up(skb->len, 4) - skb->len; > > -- > https://patchwork.kernel.org/project/linux-wireless/patch/a560caffcc24452fb48af53904bbe5c45ea5db93.1637602268.git.lorenzo@kernel.org/ > > https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches >
Lorenzo Bianconi <lorenzo@kernel.org> writes: >> Lorenzo Bianconi <lorenzo@kernel.org> wrote: >> >> > Fix a possible idr pkt-id leak if the packet is dropped on tx side >> > >> > Fixes: bd1e3e7b693c ("mt76: introduce packet_id idr") >> > Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> >> > Acked-by: Felix Fietkau <nbd@nbd.name> >> >> Patch applied to wireless-drivers.git, thanks. >> >> 2a9e9857473b mt76: fix possible pktid leak > > Hi Kalle, > > Unfortunately I found a regression introduced by this patch for mt7663u (and I > guess for mt7921s as well). Do you want me to post a fix or just a v2? I don't rebase my trees, so please post a fix. I was planning to submit a pull request to net tree today, but is this so serious that I should skip that?
> Lorenzo Bianconi <lorenzo@kernel.org> writes: > > >> Lorenzo Bianconi <lorenzo@kernel.org> wrote: > >> > >> > Fix a possible idr pkt-id leak if the packet is dropped on tx side > >> > > >> > Fixes: bd1e3e7b693c ("mt76: introduce packet_id idr") > >> > Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> > >> > Acked-by: Felix Fietkau <nbd@nbd.name> > >> > >> Patch applied to wireless-drivers.git, thanks. > >> > >> 2a9e9857473b mt76: fix possible pktid leak > > > > Hi Kalle, > > > > Unfortunately I found a regression introduced by this patch for mt7663u (and I > > guess for mt7921s as well). Do you want me to post a fix or just a v2? > > I don't rebase my trees, so please post a fix. I was planning to submit > a pull request to net tree today, but is this so serious that I should > skip that? I have already tested mt7663u but I do not have mt7921s hw for testing (but the behaviour should be the same). I guess we can split the patch, just post the fix for mt7663u and let Sean the time to test it on mt7921s (I am not sure mt7921s is already available on the market). In this way you can send the PR today. What do you think? Regards, Lorenzo > > -- > https://patchwork.kernel.org/project/linux-wireless/list/ > > https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches
Lorenzo Bianconi <lorenzo@kernel.org> writes: >> Lorenzo Bianconi <lorenzo@kernel.org> writes: >> >> >> Lorenzo Bianconi <lorenzo@kernel.org> wrote: >> >> >> >> > Fix a possible idr pkt-id leak if the packet is dropped on tx side >> >> > >> >> > Fixes: bd1e3e7b693c ("mt76: introduce packet_id idr") >> >> > Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> >> >> > Acked-by: Felix Fietkau <nbd@nbd.name> >> >> >> >> Patch applied to wireless-drivers.git, thanks. >> >> >> >> 2a9e9857473b mt76: fix possible pktid leak >> > >> > Hi Kalle, >> > >> > Unfortunately I found a regression introduced by this patch for mt7663u (and I >> > guess for mt7921s as well). Do you want me to post a fix or just a v2? >> >> I don't rebase my trees, so please post a fix. I was planning to submit >> a pull request to net tree today, but is this so serious that I should >> skip that? > > I have already tested mt7663u but I do not have mt7921s hw for testing (but the > behaviour should be the same). I guess we can split the patch, just post the > fix for mt7663u and let Sean the time to test it on mt7921s (I am not sure > mt7921s is already available on the market). In this way you can send the PR > today. What do you think? I think it's best to wait, I prefer to have proper build testing on my tree before I submit the pull request.
> Lorenzo Bianconi <lorenzo@kernel.org> writes: > > >> Lorenzo Bianconi <lorenzo@kernel.org> writes: > >> > >> >> Lorenzo Bianconi <lorenzo@kernel.org> wrote: > >> >> > >> >> > Fix a possible idr pkt-id leak if the packet is dropped on tx side > >> >> > > >> >> > Fixes: bd1e3e7b693c ("mt76: introduce packet_id idr") > >> >> > Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> > >> >> > Acked-by: Felix Fietkau <nbd@nbd.name> > >> >> > >> >> Patch applied to wireless-drivers.git, thanks. > >> >> > >> >> 2a9e9857473b mt76: fix possible pktid leak > >> > > >> > Hi Kalle, > >> > > >> > Unfortunately I found a regression introduced by this patch for mt7663u (and I > >> > guess for mt7921s as well). Do you want me to post a fix or just a v2? > >> > >> I don't rebase my trees, so please post a fix. I was planning to submit > >> a pull request to net tree today, but is this so serious that I should > >> skip that? > > > > I have already tested mt7663u but I do not have mt7921s hw for testing (but the > > behaviour should be the same). I guess we can split the patch, just post the > > fix for mt7663u and let Sean the time to test it on mt7921s (I am not sure > > mt7921s is already available on the market). In this way you can send the PR > > today. What do you think? > > I think it's best to wait, I prefer to have proper build testing on my > tree before I submit the pull request. ack, fine to me. Let's wait for Sean in this case. Regards, Lorenzo > > -- > https://patchwork.kernel.org/project/linux-wireless/list/ > > https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches
> > Lorenzo Bianconi <lorenzo@kernel.org> writes: > > > > >> Lorenzo Bianconi <lorenzo@kernel.org> writes: > > >> > > >> >> Lorenzo Bianconi <lorenzo@kernel.org> wrote: > > >> >> > > >> >> > Fix a possible idr pkt-id leak if the packet is dropped on tx side > > >> >> > > > >> >> > Fixes: bd1e3e7b693c ("mt76: introduce packet_id idr") > > >> >> > Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> > > >> >> > Acked-by: Felix Fietkau <nbd@nbd.name> > > >> >> > > >> >> Patch applied to wireless-drivers.git, thanks. > > >> >> > > >> >> 2a9e9857473b mt76: fix possible pktid leak > > >> > > > >> > Hi Kalle, > > >> > > > >> > Unfortunately I found a regression introduced by this patch for mt7663u (and I > > >> > guess for mt7921s as well). Do you want me to post a fix or just a v2? > > >> > > >> I don't rebase my trees, so please post a fix. I was planning to submit > > >> a pull request to net tree today, but is this so serious that I should > > >> skip that? > > > > > > I have already tested mt7663u but I do not have mt7921s hw for testing (but the > > > behaviour should be the same). I guess we can split the patch, just post the > > > fix for mt7663u and let Sean the time to test it on mt7921s (I am not sure > > > mt7921s is already available on the market). In this way you can send the PR > > > today. What do you think? > > > > I think it's best to wait, I prefer to have proper build testing on my > > tree before I submit the pull request. > > ack, fine to me. Let's wait for Sean in this case. @Sean: if you want to test the code the patch is available here: https://github.com/LorenzoBianconi/wireless-drivers/commit/1ffda36c7cbe3a6cfc31868895417d0cd6755306 Regards, Lorenzo > > Regards, > Lorenzo > > > > > -- > > https://patchwork.kernel.org/project/linux-wireless/list/ > > > > https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches
Lorenzo Bianconi <lorenzo@kernel.org> writes: >> > Lorenzo Bianconi <lorenzo@kernel.org> writes: >> > >> > >> Lorenzo Bianconi <lorenzo@kernel.org> writes: >> > >> >> > >> >> Lorenzo Bianconi <lorenzo@kernel.org> wrote: >> > >> >> >> > >> >> > Fix a possible idr pkt-id leak if the packet is dropped on tx side >> > >> >> > >> > >> >> > Fixes: bd1e3e7b693c ("mt76: introduce packet_id idr") >> > >> >> > Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> >> > >> >> > Acked-by: Felix Fietkau <nbd@nbd.name> >> > >> >> >> > >> >> Patch applied to wireless-drivers.git, thanks. >> > >> >> >> > >> >> 2a9e9857473b mt76: fix possible pktid leak >> > >> > >> > >> > Hi Kalle, >> > >> > >> > >> > Unfortunately I found a regression introduced by this patch >> > >> > for mt7663u (and I >> > >> > guess for mt7921s as well). Do you want me to post a fix or just a v2? >> > >> >> > >> I don't rebase my trees, so please post a fix. I was planning to submit >> > >> a pull request to net tree today, but is this so serious that I should >> > >> skip that? >> > > >> > > I have already tested mt7663u but I do not have mt7921s hw for testing (but the >> > > behaviour should be the same). I guess we can split the patch, just post the >> > > fix for mt7663u and let Sean the time to test it on mt7921s (I am not sure >> > > mt7921s is already available on the market). In this way you can send the PR >> > > today. What do you think? >> > >> > I think it's best to wait, I prefer to have proper build testing on my >> > tree before I submit the pull request. >> >> ack, fine to me. Let's wait for Sean in this case. > > @Sean: if you want to test the code the patch is available here: > https://github.com/LorenzoBianconi/wireless-drivers/commit/1ffda36c7cbe3a6cfc31868895417d0cd6755306 And if we can't find a quick fix let's just revert 2a9e9857473b. I can't wait too long.
> Lorenzo Bianconi <lorenzo@kernel.org> writes: > > >> > Lorenzo Bianconi <lorenzo@kernel.org> writes: > >> > > >> > >> Lorenzo Bianconi <lorenzo@kernel.org> writes: > >> > >> > >> > >> >> Lorenzo Bianconi <lorenzo@kernel.org> wrote: > >> > >> >> > >> > >> >> > Fix a possible idr pkt-id leak if the packet is dropped on tx side > >> > >> >> > > >> > >> >> > Fixes: bd1e3e7b693c ("mt76: introduce packet_id idr") > >> > >> >> > Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> > >> > >> >> > Acked-by: Felix Fietkau <nbd@nbd.name> > >> > >> >> > >> > >> >> Patch applied to wireless-drivers.git, thanks. > >> > >> >> > >> > >> >> 2a9e9857473b mt76: fix possible pktid leak > >> > >> > > >> > >> > Hi Kalle, > >> > >> > > >> > >> > Unfortunately I found a regression introduced by this patch > >> > >> > for mt7663u (and I > >> > >> > guess for mt7921s as well). Do you want me to post a fix or just a v2? > >> > >> > >> > >> I don't rebase my trees, so please post a fix. I was planning to submit > >> > >> a pull request to net tree today, but is this so serious that I should > >> > >> skip that? > >> > > > >> > > I have already tested mt7663u but I do not have mt7921s hw for testing (but the > >> > > behaviour should be the same). I guess we can split the patch, just post the > >> > > fix for mt7663u and let Sean the time to test it on mt7921s (I am not sure > >> > > mt7921s is already available on the market). In this way you can send the PR > >> > > today. What do you think? > >> > > >> > I think it's best to wait, I prefer to have proper build testing on my > >> > tree before I submit the pull request. > >> > >> ack, fine to me. Let's wait for Sean in this case. > > > > @Sean: if you want to test the code the patch is available here: > > https://github.com/LorenzoBianconi/wireless-drivers/commit/1ffda36c7cbe3a6cfc31868895417d0cd6755306 > > And if we can't find a quick fix let's just revert 2a9e9857473b. I can't > wait too long. ack, Deren verified the fix. I will post it now. Regards, Lorenzo > > -- > https://patchwork.kernel.org/project/linux-wireless/list/ > > https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches >
diff --git a/drivers/net/wireless/mediatek/mt76/mt7615/pci_mac.c b/drivers/net/wireless/mediatek/mt76/mt7615/pci_mac.c index 5ee52cd70a4b..d1806f198aed 100644 --- a/drivers/net/wireless/mediatek/mt76/mt7615/pci_mac.c +++ b/drivers/net/wireless/mediatek/mt76/mt7615/pci_mac.c @@ -143,8 +143,6 @@ int mt7615_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr, if (!wcid) wcid = &dev->mt76.global_wcid; - pid = mt76_tx_status_skb_add(mdev, wcid, tx_info->skb); - if ((info->flags & IEEE80211_TX_CTL_RATE_CTRL_PROBE) && msta) { struct mt7615_phy *phy = &dev->phy; @@ -164,6 +162,7 @@ int mt7615_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr, if (id < 0) return id; + pid = mt76_tx_status_skb_add(mdev, wcid, tx_info->skb); mt7615_mac_write_txwi(dev, txwi_ptr, tx_info->skb, wcid, sta, pid, key, false); diff --git a/drivers/net/wireless/mediatek/mt76/mt7615/usb_sdio.c b/drivers/net/wireless/mediatek/mt76/mt7615/usb_sdio.c index bd2939ebcbf4..bfe6c1579dc1 100644 --- a/drivers/net/wireless/mediatek/mt76/mt7615/usb_sdio.c +++ b/drivers/net/wireless/mediatek/mt76/mt7615/usb_sdio.c @@ -43,17 +43,11 @@ EXPORT_SYMBOL_GPL(mt7663_usb_sdio_reg_map); static void mt7663_usb_sdio_write_txwi(struct mt7615_dev *dev, struct mt76_wcid *wcid, enum mt76_txq_id qid, struct ieee80211_sta *sta, - struct sk_buff *skb) + int pid, struct sk_buff *skb) { struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb); struct ieee80211_key_conf *key = info->control.hw_key; __le32 *txwi; - int pid; - - if (!wcid) - wcid = &dev->mt76.global_wcid; - - pid = mt76_tx_status_skb_add(&dev->mt76, wcid, skb); txwi = (__le32 *)(skb->data - MT_USB_TXD_SIZE); memset(txwi, 0, MT_USB_TXD_SIZE); @@ -195,9 +189,12 @@ int mt7663_usb_sdio_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr, struct sk_buff *skb = tx_info->skb; struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb); struct mt7615_sta *msta; - int pad; + int pad, err, pktid; msta = wcid ? container_of(wcid, struct mt7615_sta, wcid) : NULL; + if (!wcid) + wcid = &dev->mt76.global_wcid; + if ((info->flags & IEEE80211_TX_CTL_RATE_CTRL_PROBE) && msta && !msta->rate_probe) { /* request to configure sampling rate */ @@ -207,7 +204,8 @@ int mt7663_usb_sdio_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr, spin_unlock_bh(&dev->mt76.lock); } - mt7663_usb_sdio_write_txwi(dev, wcid, qid, sta, skb); + pktid = mt76_tx_status_skb_add(&dev->mt76, wcid, skb); + mt7663_usb_sdio_write_txwi(dev, wcid, qid, sta, pktid, skb); if (mt76_is_usb(mdev)) { u32 len = skb->len; @@ -217,7 +215,12 @@ int mt7663_usb_sdio_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr, pad = round_up(skb->len, 4) - skb->len; } - return mt76_skb_adjust_pad(skb, pad); + err = mt76_skb_adjust_pad(skb, pad); + if (err) + /* Release pktid in case of error. */ + idr_remove(&wcid->pktid, pktid); + + return err; } EXPORT_SYMBOL_GPL(mt7663_usb_sdio_tx_prepare_skb); diff --git a/drivers/net/wireless/mediatek/mt76/mt76x02_usb_core.c b/drivers/net/wireless/mediatek/mt76/mt76x02_usb_core.c index efd70ddc2fd1..2c6c03809b20 100644 --- a/drivers/net/wireless/mediatek/mt76/mt76x02_usb_core.c +++ b/drivers/net/wireless/mediatek/mt76/mt76x02_usb_core.c @@ -72,6 +72,7 @@ int mt76x02u_tx_prepare_skb(struct mt76_dev *mdev, void *data, bool ampdu = IEEE80211_SKB_CB(tx_info->skb)->flags & IEEE80211_TX_CTL_AMPDU; enum mt76_qsel qsel; u32 flags; + int err; mt76_insert_hdr_pad(tx_info->skb); @@ -106,7 +107,12 @@ int mt76x02u_tx_prepare_skb(struct mt76_dev *mdev, void *data, ewma_pktlen_add(&msta->pktlen, tx_info->skb->len); } - return mt76x02u_skb_dma_info(tx_info->skb, WLAN_PORT, flags); + err = mt76x02u_skb_dma_info(tx_info->skb, WLAN_PORT, flags); + if (err && wcid) + /* Release pktid in case of error. */ + idr_remove(&wcid->pktid, pid); + + return err; } EXPORT_SYMBOL_GPL(mt76x02u_tx_prepare_skb); diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/mac.c b/drivers/net/wireless/mediatek/mt76/mt7915/mac.c index 5fcf35f2d9fb..809dc18e5083 100644 --- a/drivers/net/wireless/mediatek/mt76/mt7915/mac.c +++ b/drivers/net/wireless/mediatek/mt76/mt7915/mac.c @@ -1151,8 +1151,14 @@ int mt7915_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr, } } - pid = mt76_tx_status_skb_add(mdev, wcid, tx_info->skb); + t = (struct mt76_txwi_cache *)(txwi + mdev->drv->txwi_size); + t->skb = tx_info->skb; + + id = mt76_token_consume(mdev, &t); + if (id < 0) + return id; + pid = mt76_tx_status_skb_add(mdev, wcid, tx_info->skb); mt7915_mac_write_txwi(dev, txwi_ptr, tx_info->skb, wcid, pid, key, false); @@ -1178,13 +1184,6 @@ int mt7915_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr, txp->bss_idx = mvif->idx; } - t = (struct mt76_txwi_cache *)(txwi + mdev->drv->txwi_size); - t->skb = tx_info->skb; - - id = mt76_token_consume(mdev, &t); - if (id < 0) - return id; - txp->token = cpu_to_le16(id); if (test_bit(MT_WCID_FLAG_4ADDR, &wcid->flags)) txp->rept_wds_wcid = cpu_to_le16(wcid->idx); diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/sdio_mac.c b/drivers/net/wireless/mediatek/mt76/mt7921/sdio_mac.c index 137f86a6dbf8..85b3d88f8ecc 100644 --- a/drivers/net/wireless/mediatek/mt76/mt7921/sdio_mac.c +++ b/drivers/net/wireless/mediatek/mt76/mt7921/sdio_mac.c @@ -142,14 +142,12 @@ int mt7921s_mac_reset(struct mt7921_dev *dev) static void mt7921s_write_txwi(struct mt7921_dev *dev, struct mt76_wcid *wcid, enum mt76_txq_id qid, struct ieee80211_sta *sta, - struct sk_buff *skb) + int pid, struct sk_buff *skb) { struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb); struct ieee80211_key_conf *key = info->control.hw_key; __le32 *txwi; - int pid; - pid = mt76_tx_status_skb_add(&dev->mt76, wcid, skb); txwi = (__le32 *)(skb->data - MT_SDIO_TXD_SIZE); memset(txwi, 0, MT_SDIO_TXD_SIZE); mt7921_mac_write_txwi(dev, txwi, skb, wcid, key, pid, false); @@ -164,7 +162,7 @@ int mt7921s_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr, struct mt7921_dev *dev = container_of(mdev, struct mt7921_dev, mt76); struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx_info->skb); struct sk_buff *skb = tx_info->skb; - int pad; + int err, pad, pktid; if (unlikely(tx_info->skb->len <= ETH_HLEN)) return -EINVAL; @@ -181,12 +179,18 @@ int mt7921s_tx_prepare_skb(struct mt76_dev *mdev, void *txwi_ptr, } } - mt7921s_write_txwi(dev, wcid, qid, sta, skb); + pktid = mt76_tx_status_skb_add(&dev->mt76, wcid, skb); + mt7921s_write_txwi(dev, wcid, qid, sta, pktid, skb); mt7921_skb_add_sdio_hdr(skb, MT7921_SDIO_DATA); pad = round_up(skb->len, 4) - skb->len; - return mt76_skb_adjust_pad(skb, pad); + err = mt76_skb_adjust_pad(skb, pad); + if (err) + /* Release pktid in case of error. */ + idr_remove(&wcid->pktid, pktid); + + return err; } void mt7921s_tx_complete_skb(struct mt76_dev *mdev, struct mt76_queue_entry *e)
Fix a possible idr pkt-id leak if the packet is dropped on tx side Fixes: bd1e3e7b693c ("mt76: introduce packet_id idr") Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org> --- .../wireless/mediatek/mt76/mt7615/pci_mac.c | 3 +-- .../wireless/mediatek/mt76/mt7615/usb_sdio.c | 23 +++++++++++-------- .../wireless/mediatek/mt76/mt76x02_usb_core.c | 8 ++++++- .../net/wireless/mediatek/mt76/mt7915/mac.c | 15 ++++++------ .../wireless/mediatek/mt76/mt7921/sdio_mac.c | 16 ++++++++----- 5 files changed, 38 insertions(+), 27 deletions(-)