[PATCH mt76-next 04/11] wifi: mt76: mt7925: free the MCU event when linearising fails

[Felix Fietkau <nbd@nbd.name>]

mt7925_mcu_rx_event() returns without freeing the skb when
skb_linearize() fails, which leaks the event.

Free it, like mt7921_mcu_rx_event() does.

While here, take the descriptor pointer only after linearising, since
skb_linearize() can reallocate the skb head.

Fixes: c948b5da6bbe ("wifi: mt76: mt7925: add Mediatek Wi-Fi7 driver for mt7925 chips")
Signed-off-by: Felix Fietkau <nbd@nbd.name>
---
 drivers/net/wireless/mediatek/mt76/mt7925/mcu.c | 9 ++++-----
 1 file changed, 4 insertions(+), 5 deletions(-)

diff --git a/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c
index d26b90ab5e60..2acb02add18f 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7925/mcu.c
@@ -740,16 +740,15 @@ mt7925_mcu_uni_rx_unsolicited_event(struct mt792x_dev *dev,
 
 void mt7925_mcu_rx_event(struct mt792x_dev *dev, struct sk_buff *skb)
 {
-	struct mt7925_mcu_rxd *rxd = (struct mt7925_mcu_rxd *)skb->data;
+	struct mt7925_mcu_rxd *rxd;
 
-	if (skb_linearize(skb))
-		return;
-
-	if (skb->len < offsetofend(struct mt7925_mcu_rxd, ext_eid)) {
+	if (skb_linearize(skb) ||
+	    skb->len < offsetofend(struct mt7925_mcu_rxd, ext_eid)) {
 		dev_kfree_skb(skb);
 		return;
 	}
 
+	rxd = (struct mt7925_mcu_rxd *)skb->data;
 	if (rxd->option & MCU_UNI_CMD_UNSOLICITED_EVENT) {
 		mt7925_mcu_uni_rx_unsolicited_event(dev, skb);
 		return;
-- 
2.47.3