Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit baabd567 authored by Malcolm Priestley's avatar Malcolm Priestley Committed by Greg Kroah-Hartman
Browse files

staging: rtl8192e: rtl92e_fill_tx_desc fix write to mapped out memory. 



The driver attempts to alter memory that is mapped to PCI device.

This is because tx_fwinfo_8190pci points to skb->data

Move the pci_map_single to when completed buffer is ready to be mapped with
psdec is empty to drop on mapping error.

Signed-off-by: default avatarMalcolm Priestley <tvboxspy@gmail.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent ff92b9e3

drivers/staging/rtl8192e/rtl8192e/r8192E_dev.c

+9 −4
Original line number Original line Diff line number Diff line
@@ -1182,8 +1182,7 @@ void rtl92e_fill_tx_desc(struct net_device *dev, struct tx_desc *pdesc, 
			  struct cb_desc *cb_desc, struct sk_buff *skb)

			  struct cb_desc *cb_desc, struct sk_buff *skb)

{

{

	struct r8192_priv *priv = rtllib_priv(dev);

	struct r8192_priv *priv = rtllib_priv(dev);

	dma_addr_t mapping = pci_map_single(priv->pdev, skb->data, skb->len,

	dma_addr_t mapping;

			 PCI_DMA_TODEVICE);

	struct tx_fwinfo_8190pci *pTxFwInfo;

	struct tx_fwinfo_8190pci *pTxFwInfo;





	pTxFwInfo = (struct tx_fwinfo_8190pci *)skb->data;

	pTxFwInfo = (struct tx_fwinfo_8190pci *)skb->data;
@@ -1194,8 +1193,6 @@ void rtl92e_fill_tx_desc(struct net_device *dev, struct tx_desc *pdesc, 
	pTxFwInfo->Short = _rtl92e_query_is_short(pTxFwInfo->TxHT,

	pTxFwInfo->Short = _rtl92e_query_is_short(pTxFwInfo->TxHT,

						  pTxFwInfo->TxRate, cb_desc);

						  pTxFwInfo->TxRate, cb_desc);





	if (pci_dma_mapping_error(priv->pdev, mapping))

		netdev_err(dev, "%s(): DMA Mapping error\n", __func__);

	if (cb_desc->bAMPDUEnable) {

	if (cb_desc->bAMPDUEnable) {

		pTxFwInfo->AllowAggregation = 1;

		pTxFwInfo->AllowAggregation = 1;

		pTxFwInfo->RxMF = cb_desc->ampdu_factor;

		pTxFwInfo->RxMF = cb_desc->ampdu_factor;
@@ -1230,6 +1227,14 @@ void rtl92e_fill_tx_desc(struct net_device *dev, struct tx_desc *pdesc, 
	}

	}





	memset((u8 *)pdesc, 0, 12);

	memset((u8 *)pdesc, 0, 12);



	mapping = pci_map_single(priv->pdev, skb->data, skb->len,

				 PCI_DMA_TODEVICE);

	if (pci_dma_mapping_error(priv->pdev, mapping)) {

		netdev_err(dev, "%s(): DMA Mapping error\n", __func__);

		return;

	}



	pdesc->LINIP = 0;

	pdesc->LINIP = 0;

	pdesc->CmdInit = 1;

	pdesc->CmdInit = 1;

	pdesc->Offset = sizeof(struct tx_fwinfo_8190pci) + 8;

	pdesc->Offset = sizeof(struct tx_fwinfo_8190pci) + 8;