recipes-wifi/linux-mt76/files/patches/3012-mt76-mt7915-wed-fix-potential-memory-leakage.patch

From 5f7175246f6a734b63ecd336f1b3ad0bc4f37048 Mon Sep 17 00:00:00 2001
From: Sujuan Chen <sujuan.chen@mediatek.com>
Date: Fri, 6 Jan 2023 18:25:51 +0800
Subject: [PATCH 3012/3014] mt76: mt7915: wed: fix potential memory leakage

release rx queue pages in mt7915_mmio_wed_release_rx_buf.
recycle rxwi when mt76_dma_add_buf() call fails.

Signed-off-by: Sujuan Chen <sujuan.chen@mediatek.com>
---
 dma.c         | 12 +++++++-----
 mt7915/mmio.c | 15 +++++++++++++++
 2 files changed, 22 insertions(+), 5 deletions(-)

diff --git a/dma.c b/dma.c
index 21f26df7..cb1fd9c6 100644
--- a/dma.c
+++ b/dma.c
@@ -795,12 +795,14 @@ mt76_dma_rx_cleanup(struct mt76_dev *dev, struct mt76_queue *q)
 	} while (1);
 	spin_unlock_bh(&q->lock);
 
-	if (!q->rx_page.va)
-		return;
+	if (FIELD_GET(MT_QFLAG_WED_TYPE, q->flags) != MT76_WED_Q_RX) {
+		if (!q->rx_page.va)
+			return;
 
-	page = virt_to_page(q->rx_page.va);
-	__page_frag_cache_drain(page, q->rx_page.pagecnt_bias);
-	memset(&q->rx_page, 0, sizeof(q->rx_page));
+		page = virt_to_page(q->rx_page.va);
+		__page_frag_cache_drain(page, q->rx_page.pagecnt_bias);
+		memset(&q->rx_page, 0, sizeof(q->rx_page));
+	}
 }
 
 static void
diff --git a/mt7915/mmio.c b/mt7915/mmio.c
index 09b39730..419338cc 100644
--- a/mt7915/mmio.c
+++ b/mt7915/mmio.c
@@ -621,12 +621,27 @@ static void mt7915_mmio_wed_release_rx_buf(struct mtk_wed_device *wed)
 
 	mt76_free_pending_rxwi(&dev->mt76);
 
+	mt76_for_each_q_rx(&dev->mt76, i) {
+		if (FIELD_GET(MT_QFLAG_WED_TYPE,
+			      dev->mt76.q_rx[i].flags) == MT76_WED_Q_RX) {
+			struct mt76_queue *q = &dev->mt76.q_rx[i];
+
+			if (!q->rx_page.va)
+				continue;
+
+			page = virt_to_page(q->rx_page.va);
+			__page_frag_cache_drain(page, q->rx_page.pagecnt_bias);
+			memset(&q->rx_page, 0, sizeof(q->rx_page));
+		}
+	}
+
 	if (!wed->rx_buf_ring.rx_page.va)
 		return;
 
 	page = virt_to_page(wed->rx_buf_ring.rx_page.va);
 	__page_frag_cache_drain(page, wed->rx_buf_ring.rx_page.pagecnt_bias);
 	memset(&wed->rx_buf_ring.rx_page, 0, sizeof(wed->rx_buf_ring.rx_page));
+
 }
 
 static u32 mt7915_mmio_wed_init_rx_buf(struct mtk_wed_device *wed, int size)
-- 
2.18.0