[PATCH] [BACKPORT FOR 4.4] staging: rtl8192e: rtl92e_fill_tx_desc fix write to mapped out memory.

[PATCH] [BACKPORT FOR 4.4] staging: rtl8192e: rtl92e_fill_tx_desc fix write to mapped out memory.

[Malcolm Priestley]

The driver attempts to alter memory that is mapped to PCI device.

This is because tx_fwinfo_8190pci points to skb->data

Move the pci_map_single to when completed buffer is ready to be mapped with
psdec is empty to drop on mapping error.

Signed-off-by: Malcolm Priestley <tvboxspy@gmail.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
Commit baabd567f87be05330faa5140f72a91960e7405a upstream

Commit 95d93e271d920dfda369d4740b1cc1061d41fe7f upstream is also required.


 drivers/staging/rtl8192e/rtl8192e/r8192E_dev.c | 13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

diff --git a/drivers/staging/rtl8192e/rtl8192e/r8192E_dev.c b/drivers/staging/rtl8192e/rtl8192e/r8192E_dev.c
index 79bf13f..7a8ceb9 100644
--- a/drivers/staging/rtl8192e/rtl8192e/r8192E_dev.c
+++ b/drivers/staging/rtl8192e/rtl8192e/r8192E_dev.c
@@ -1185,8 +1185,7 @@ void  rtl92e_fill_tx_desc(struct net_device *dev, struct tx_desc *pdesc,
 			  struct cb_desc *cb_desc, struct sk_buff *skb)
 {
 	struct r8192_priv *priv = rtllib_priv(dev);
-	dma_addr_t mapping = pci_map_single(priv->pdev, skb->data, skb->len,
-			 PCI_DMA_TODEVICE);
+	dma_addr_t mapping;
 	struct tx_fwinfo_8190pci *pTxFwInfo = NULL;
 
 	pTxFwInfo = (struct tx_fwinfo_8190pci *)skb->data;
@@ -1197,8 +1196,6 @@ void  rtl92e_fill_tx_desc(struct net_device *dev, struct tx_desc *pdesc,
 	pTxFwInfo->Short = _rtl92e_query_is_short(pTxFwInfo->TxHT,
 						  pTxFwInfo->TxRate, cb_desc);
 
-	if (pci_dma_mapping_error(priv->pdev, mapping))
-		netdev_err(dev, "%s(): DMA Mapping error\n", __func__);
 	if (cb_desc->bAMPDUEnable) {
 		pTxFwInfo->AllowAggregation = 1;
 		pTxFwInfo->RxMF = cb_desc->ampdu_factor;
@@ -1233,6 +1230,14 @@ void  rtl92e_fill_tx_desc(struct net_device *dev, struct tx_desc *pdesc,
 	}
 
 	memset((u8 *)pdesc, 0, 12);
+
+	mapping = pci_map_single(priv->pdev, skb->data, skb->len,
+				 PCI_DMA_TODEVICE);
+	if (pci_dma_mapping_error(priv->pdev, mapping)) {
+		netdev_err(dev, "%s(): DMA Mapping error\n", __func__);
+		return;
+	}
+
 	pdesc->LINIP = 0;
 	pdesc->CmdInit = 1;
 	pdesc->Offset = sizeof(struct tx_fwinfo_8190pci) + 8;
-- 
2.7.4

Re: [PATCH] [BACKPORT FOR 4.4] staging: rtl8192e: rtl92e_fill_tx_desc fix write to mapped out memory.

[Greg KH]

On Tue, Jun 13, 2017 at 12:38:02PM +0100, Malcolm Priestley wrote:
> The driver attempts to alter memory that is mapped to PCI device.
> 
> This is because tx_fwinfo_8190pci points to skb->data
> 
> Move the pci_map_single to when completed buffer is ready to be mapped with
> psdec is empty to drop on mapping error.
> 
> Signed-off-by: Malcolm Priestley <tvboxspy@gmail.com>
> Cc: <stable@vger.kernel.org>
> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> 
> ---
> Commit baabd567f87be05330faa5140f72a91960e7405a upstream

Thanks for this.

> Commit 95d93e271d920dfda369d4740b1cc1061d41fe7f upstream is also required.

That one does not apply, can you provide a backport for it?

thanks,

greg k-h

Re: [PATCH] [BACKPORT FOR 4.4] staging: rtl8192e: rtl92e_fill_tx_desc fix write to mapped out memory.

[Malcolm Priestley]

On 15/06/17 08:21, Greg KH wrote:
> On Tue, Jun 13, 2017 at 12:38:02PM +0100, Malcolm Priestley wrote:
>> The driver attempts to alter memory that is mapped to PCI device.
>>
>> This is because tx_fwinfo_8190pci points to skb->data
>>
>> Move the pci_map_single to when completed buffer is ready to be mapped with
>> psdec is empty to drop on mapping error.
>>
>> Signed-off-by: Malcolm Priestley <tvboxspy@gmail.com>
>> Cc: <stable@vger.kernel.org>
>> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
>>
>> ---
>> Commit baabd567f87be05330faa5140f72a91960e7405a upstream
> 
> Thanks for this.
> 
>> Commit 95d93e271d920dfda369d4740b1cc1061d41fe7f upstream is also required.
> 
> That one does not apply, can you provide a backport for it?
> 

Sorry it is not needed, the bug had appeared since v4.4.

IsACValid had since changed to static function where the math error of
tid < 7 appears.

Regards


Malcolm