[PATCH 1/3] wifi: mt76: mt7615: fix DMA read beyond mapped length

[Joshua Klinesmith <joshuaklinesmith@gmail.com>]

tx_prepare_skb() overrides buf[1].len to MT_CT_PARSE_LEN (72)
for firmware header parsing, but dma_map_single() only maps
skb_headlen(skb) bytes. When the SKB is shorter than 72 bytes,
the hardware reads past the DMA-mapped region, causing SMMU
translation faults on IOMMU-enabled systems.

Cap the firmware parse length to the actual DMA-mapped length.

Fixes: e90354e0452d ("mt76: mt7615: move core shared code in mt7615-common module")
Cc: stable@vger.kernel.org
Signed-off-by: Joshua Klinesmith <joshuaklinesmith@gmail.com>
---
 drivers/net/wireless/mediatek/mt76/mt7615/pci_mac.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/wireless/mediatek/mt76/mt7615/pci_mac.c b/drivers/net/wireless/mediatek/mt76/mt7615/pci_mac.c
index 53cb1eed1e4f..dc7128c46a72 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7615/pci_mac.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7615/pci_mac.c
@@ -35,7 +35,7 @@ mt7615_write_fw_txp(struct mt7615_dev *dev, struct mt76_tx_info *tx_info,
 
 	/* pass partial skb header to fw */
 	tx_info->buf[0].len = MT_TXD_SIZE + sizeof(*txp);
-	tx_info->buf[1].len = MT_CT_PARSE_LEN;
+	tx_info->buf[1].len = min_t(u32, MT_CT_PARSE_LEN, tx_info->buf[1].len);
 	tx_info->buf[1].skip_unmap = true;
 	tx_info->nbuf = MT_CT_DMA_BUF_NUM;
 
-- 
2.43.0