From 1f8284150dbc6a6995d8647be025944ebc29ad26 Mon Sep 17 00:00:00 2001
From: Lorenzo Bianconi <lorenzo@kernel.org>
Date: Fri, 17 Jul 2020 10:57:39 +0200
Subject: [PATCH] mt76: mt76s: move queue accounting in mt76s_tx_queue_skb
Git-commit: 1f8284150dbc6a6995d8647be025944ebc29ad26
Patch-mainline: v5.9-rc1
References: jsc#SLE-13430

In order to avoid possible overflows, move tx queue accounting from
mt7663s_tx_run_queue() to mt76s_tx_queue_skb_raw()/mt76s_tx_queue_skb()

Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Acked-by: Takashi Iwai <tiwai@suse.de>

---
 drivers/net/wireless/mediatek/mt76/mt7615/sdio_txrx.c | 5 +----
 drivers/net/wireless/mediatek/mt76/sdio.c             | 5 +++++
 2 files changed, 6 insertions(+), 4 deletions(-)

diff --git a/drivers/net/wireless/mediatek/mt76/mt7615/sdio_txrx.c b/drivers/net/wireless/mediatek/mt76/mt7615/sdio_txrx.c
index 156666a94eb7..443a4ecdad3a 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7615/sdio_txrx.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7615/sdio_txrx.c
@@ -180,14 +180,11 @@ static int mt7663s_tx_run_queue(struct mt7615_dev *dev, struct mt76_queue *q)
 			return -EIO;
 		}
 
+		e->done = true;
 		q->first = (q->first + 1) % q->ndesc;
 		nframes++;
 	}
 
-	spin_lock_bh(&q->lock);
-	q->queued += nframes;
-	spin_unlock_bh(&q->lock);
-
 	return nframes;
 }
 
diff --git a/drivers/net/wireless/mediatek/mt76/sdio.c b/drivers/net/wireless/mediatek/mt76/sdio.c
index a6f3255c4d84..d2b38ed7f3b4 100644
--- a/drivers/net/wireless/mediatek/mt76/sdio.c
+++ b/drivers/net/wireless/mediatek/mt76/sdio.c
@@ -138,6 +138,9 @@ static int mt76s_process_tx_queue(struct mt76_dev *dev, enum mt76_txq_id qid)
 	bool wake;
 
 	while (q->queued > n_dequeued) {
+		if (!q->entry[q->head].done)
+			break;
+
 		if (q->entry[q->head].schedule) {
 			q->entry[q->head].schedule = false;
 			n_sw_dequeued++;
@@ -229,6 +232,7 @@ mt76s_tx_queue_skb(struct mt76_dev *dev, enum mt76_txq_id qid,
 	q->entry[q->tail].skb = tx_info.skb;
 	q->entry[q->tail].buf_sz = len;
 	q->tail = (q->tail + 1) % q->ndesc;
+	q->queued++;
 
 	return idx;
 }
@@ -251,6 +255,7 @@ mt76s_tx_queue_skb_raw(struct mt76_dev *dev, enum mt76_txq_id qid,
 	q->entry[q->tail].buf_sz = len;
 	q->entry[q->tail].skb = skb;
 	q->tail = (q->tail + 1) % q->ndesc;
+	q->queued++;
 
 out:
 	spin_unlock_bh(&q->lock);
-- 
2.16.4