Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 47d13823 authored by Alexey Khoroshilov's avatar Alexey Khoroshilov Committed by Greg Kroah-Hartman
Browse files

adm80211: add checks for dma mapping errors 




[ Upstream commit d15697de60db5570532fdedb8e13b2251d65b8e3 ]

The driver does not check if mapping dma memory succeed.
The patch adds the checks and failure handling.

Found by Linux Driver Verification project (linuxtesting.org).

Signed-off-by: default avatarAlexey Khoroshilov <khoroshilov@ispras.ru>
Signed-off-by: default avatarKalle Valo <kvalo@codeaurora.org>
Signed-off-by: default avatarSasha Levin <alexander.levin@verizon.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 26b6ab58

drivers/net/wireless/admtek/adm8211.c

+22 −2
Original line number Diff line number Diff line
@@ -413,6 +413,13 @@ static void adm8211_interrupt_rci(struct ieee80211_hw *dev) 
						       skb_tail_pointer(newskb),

						       RX_PKT_SIZE,

						       PCI_DMA_FROMDEVICE);

				if (pci_dma_mapping_error(priv->pdev,

					   priv->rx_buffers[entry].mapping)) {

					priv->rx_buffers[entry].skb = NULL;

					dev_kfree_skb(newskb);

					skb = NULL;

					/* TODO: update rx dropped stats */

				}

			} else {

				skb = NULL;

				/* TODO: update rx dropped stats */
@@ -1450,6 +1457,12 @@ static int adm8211_init_rings(struct ieee80211_hw *dev) 
						  skb_tail_pointer(rx_info->skb),

						  RX_PKT_SIZE,

						  PCI_DMA_FROMDEVICE);

		if (pci_dma_mapping_error(priv->pdev, rx_info->mapping)) {

			dev_kfree_skb(rx_info->skb);

			rx_info->skb = NULL;

			break;

		}



		desc->buffer1 = cpu_to_le32(rx_info->mapping);

		desc->status = cpu_to_le32(RDES0_STATUS_OWN | RDES0_STATUS_SQL);

	}
@@ -1613,7 +1626,7 @@ static void adm8211_calc_durations(int *dur, int *plcp, size_t payload_len, int 
}



/* Transmit skb w/adm8211_tx_hdr (802.11 header created by hardware) */

static void adm8211_tx_raw(struct ieee80211_hw *dev, struct sk_buff *skb,

static int adm8211_tx_raw(struct ieee80211_hw *dev, struct sk_buff *skb,

			   u16 plcp_signal,

			   size_t hdrlen)

{
@@ -1625,6 +1638,8 @@ static void adm8211_tx_raw(struct ieee80211_hw *dev, struct sk_buff *skb, 


	mapping = pci_map_single(priv->pdev, skb->data, skb->len,

				 PCI_DMA_TODEVICE);

	if (pci_dma_mapping_error(priv->pdev, mapping))

		return -ENOMEM;



	spin_lock_irqsave(&priv->lock, flags);
@@ -1657,6 +1672,8 @@ static void adm8211_tx_raw(struct ieee80211_hw *dev, struct sk_buff *skb, 


	/* Trigger transmit poll */

	ADM8211_CSR_WRITE(TDR, 0);



	return 0;

}



/* Put adm8211_tx_hdr on skb and transmit */
@@ -1710,7 +1727,10 @@ static void adm8211_tx(struct ieee80211_hw *dev, 


	txhdr->retry_limit = info->control.rates[0].count;



	adm8211_tx_raw(dev, skb, plcp_signal, hdrlen);

	if (adm8211_tx_raw(dev, skb, plcp_signal, hdrlen)) {

		/* Drop packet */

		ieee80211_free_txskb(dev, skb);

	}

}



static int adm8211_alloc_rings(struct ieee80211_hw *dev)