wifi: rtw89: usb: use common error path for skbs in rtw89_usb_rx_handler()

Allow adding rx_skb to rx_free_queue for later reuse on the common error
handling path, otherwise free it.

Found by Linux Verification Center (linuxtesting.org).

Fixes: 2135c28be6a8 ("wifi: rtw89: Add usb.{c,h}")
Acked-by: Ping-Ke Shih <pkshih@realtek.com>
Signed-off-by: Fedor Pchelkin <pchelkin@ispras.ru>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Link: https://patch.msgid.link/20251104135720.321110-2-pchelkin@ispras.ru

diff --git a/drivers/net/wireless/realtek/rtw89/usb.c b/drivers/net/wireless/realtek/rtw89/usb.c
index 4c47071b30fdfb1973f9f9c5d744bd8a7ca2fca6..450631c77840b3e8d629d218db445fcd94621000 100644 (file)
--- a/drivers/net/wireless/realtek/rtw89/usb.c
+++ b/drivers/net/wireless/realtek/rtw89/usb.c
@@ -390,8 +390,7 @@ static void rtw89_usb_rx_handler(struct work_struct *work)
 
                if (skb_queue_len(&rtwusb->rx_queue) >= RTW89_USB_MAX_RXQ_LEN) {
                        rtw89_warn(rtwdev, "rx_queue overflow\n");
-                       dev_kfree_skb_any(rx_skb);
-                       continue;
+                       goto free_or_reuse;
                }
 
                memset(&desc_info, 0, sizeof(desc_info));
@@ -402,7 +401,7 @@ static void rtw89_usb_rx_handler(struct work_struct *work)
                        rtw89_debug(rtwdev, RTW89_DBG_HCI,
                                    "failed to allocate RX skb of size %u\n",
                                    desc_info.pkt_size);
-                       continue;
+                       goto free_or_reuse;
                }
 
                pkt_offset = desc_info.offset + desc_info.rxd_len;
@@ -412,6 +411,7 @@ static void rtw89_usb_rx_handler(struct work_struct *work)
 
                rtw89_core_rx(rtwdev, &desc_info, skb);
 
+free_or_reuse:
                if (skb_queue_len(&rtwusb->rx_free_queue) >= RTW89_USB_RX_SKB_NUM)
                        dev_kfree_skb_any(rx_skb);
                else