leandrof/linux
1
0
Fork 0
forked from Minki/linux
Code Issues Pull Requests Packages Projects Releases Wiki Activity

iwlwifi: unmap memory before use

Browse Source 
Handling responses to driver originated commands include passing the
original command buffer to the caller. At this time it is possible for a
callback to be invoked that is passed this command buffer and thus likely
to access it.

We need to make sure that the memory associated with that buffer is not DMA
mapped at the time.

Signed-off-by: Reinette Chatre <reinette.chatre@intel.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
This commit is contained in:
Reinette Chatre 2009-10-30 14:36:10 -07:00 committed by John W. Linville
parent c2e61da29d
commit c33de6256a
1 changed files with 5 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
drivers/net/wireless/iwlwifi/iwl-tx.c
View File

@ -1121,11 +1121,6 @@ static void iwl_hcmd_queue_reclaim(struct iwl_priv *priv, int txq_id,
return;
}
pci_unmap_single(priv->pci_dev,
pci_unmap_addr(&txq->meta[cmd_idx], mapping),
pci_unmap_len(&txq->meta[cmd_idx], len),
PCI_DMA_BIDIRECTIONAL);
for (idx = iwl_queue_inc_wrap(idx, q->n_bd); q->read_ptr != idx;
q->read_ptr = iwl_queue_inc_wrap(q->read_ptr, q->n_bd)) {
@ -1173,6 +1168,11 @@ void iwl_tx_cmd_complete(struct iwl_priv *priv, struct iwl_rx_mem_buffer *rxb)
cmd = priv->txq[IWL_CMD_QUEUE_NUM].cmd[cmd_index];
meta = &priv->txq[IWL_CMD_QUEUE_NUM].meta[cmd_index];
pci_unmap_single(priv->pci_dev,
pci_unmap_addr(meta, mapping),
pci_unmap_len(meta, len),
PCI_DMA_BIDIRECTIONAL);
/* Input error checking is done when commands are added to queue. */
if (meta->flags & CMD_WANT_SKB) {
meta->source->reply_page = (unsigned long)rxb_addr(rxb);