The mt76 queue ops take ownership of the skb handed to tx_queue_skb(): the DMA implementation releases it through ieee80211_tx_status_ext() on every error path, but mt76u_tx_queue_skb() and mt76s_tx_queue_skb() just return the error, so the reference is neither queued nor freed. mt76_testmode_tx_pending() relies on that ownership transfer, so it leaks the extra skb reference taken with skb_get() whenever the queue is full or tx_prepare_skb()/mt76u_tx_setup_buffers() fails. Release the skb on the error paths as well. Fixes: b40b15e1521f ("mt76: add usb support to mt76 layer") Fixes: d39b52e31aa6 ("mt76: introduce mt76_sdio module") Cc: stable@vger.kernel.org Signed-off-by: Wentao Liang --- drivers/net/wireless/mediatek/mt76/sdio.c | 13 ++++++++++--- drivers/net/wireless/mediatek/mt76/usb.c | 15 +++++++++++---- 2 files changed, 21 insertions(+), 7 deletions(-) diff --git a/drivers/net/wireless/mediatek/mt76/sdio.c b/drivers/net/wireless/mediatek/mt76/sdio.c index 8bae77c761be..ef82af1f905c 100644 --- a/drivers/net/wireless/mediatek/mt76/sdio.c +++ b/drivers/net/wireless/mediatek/mt76/sdio.c @@ -526,13 +526,15 @@ mt76s_tx_queue_skb(struct mt76_phy *phy, struct mt76_queue *q, int err, len = skb->len; u16 idx = q->head; - if (q->queued == q->ndesc) - return -ENOSPC; + if (q->queued == q->ndesc) { + err = -ENOSPC; + goto free_skb; + } skb->prev = skb->next = NULL; err = dev->drv->tx_prepare_skb(dev, NULL, qid, wcid, sta, &tx_info); if (err < 0) - return err; + goto free_skb; q->entry[q->head].skb = tx_info.skb; q->entry[q->head].buf_sz = len; @@ -544,6 +546,11 @@ mt76s_tx_queue_skb(struct mt76_phy *phy, struct mt76_queue *q, q->queued++; return idx; + +free_skb: + dev_kfree_skb(tx_info.skb); + + return err; } static int diff --git a/drivers/net/wireless/mediatek/mt76/usb.c b/drivers/net/wireless/mediatek/mt76/usb.c index 632ae755c7a6..837b0b251b05 100644 --- a/drivers/net/wireless/mediatek/mt76/usb.c +++ b/drivers/net/wireless/mediatek/mt76/usb.c @@ -861,17 +861,19 @@ mt76u_tx_queue_skb(struct mt76_phy *phy, struct mt76_queue *q, u16 idx = q->head; int err; - if (q->queued == q->ndesc) - return -ENOSPC; + if (q->queued == q->ndesc) { + err = -ENOSPC; + goto free_skb; + } skb->prev = skb->next = NULL; err = dev->drv->tx_prepare_skb(dev, NULL, qid, wcid, sta, &tx_info); if (err < 0) - return err; + goto free_skb; err = mt76u_tx_setup_buffers(dev, tx_info.skb, q->entry[idx].urb); if (err < 0) - return err; + goto free_skb; mt76u_fill_bulk_urb(dev, USB_DIR_OUT, q->ep, q->entry[idx].urb, mt76u_complete_tx, &q->entry[idx]); @@ -882,6 +884,11 @@ mt76u_tx_queue_skb(struct mt76_phy *phy, struct mt76_queue *q, q->queued++; return idx; + +free_skb: + dev_kfree_skb(tx_info.skb); + + return err; } static void mt76u_tx_kick(struct mt76_dev *dev, struct mt76_queue *q) -- 2.34.1