lkml.org 
[lkml]   [2020]   [Nov]   [9]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.9 009/117] p54: avoid accessing the data mapped to streaming DMA
    Date
    From: Jia-Ju Bai <baijiaju@tsinghua.edu.cn>

    commit 478762855b5ae9f68fa6ead1edf7abada70fcd5f upstream.

    In p54p_tx(), skb->data is mapped to streaming DMA on line 337:
    mapping = pci_map_single(..., skb->data, ...);

    Then skb->data is accessed on line 349:
    desc->device_addr = ((struct p54_hdr *)skb->data)->req_id;

    This access may cause data inconsistency between CPU cache and hardware.

    To fix this problem, ((struct p54_hdr *)skb->data)->req_id is stored in
    a local variable before DMA mapping, and then the driver accesses this
    local variable instead of skb->data.

    Cc: <stable@vger.kernel.org>
    Signed-off-by: Jia-Ju Bai <baijiaju@tsinghua.edu.cn>
    Acked-by: Christian Lamparter <chunkeey@gmail.com>
    Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
    Link: https://lore.kernel.org/r/20200802132949.26788-1-baijiaju@tsinghua.edu.cn
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    drivers/net/wireless/intersil/p54/p54pci.c | 4 +++-
    1 file changed, 3 insertions(+), 1 deletion(-)

    --- a/drivers/net/wireless/intersil/p54/p54pci.c
    +++ b/drivers/net/wireless/intersil/p54/p54pci.c
    @@ -332,10 +332,12 @@ static void p54p_tx(struct ieee80211_hw
    struct p54p_desc *desc;
    dma_addr_t mapping;
    u32 idx, i;
    + __le32 device_addr;

    spin_lock_irqsave(&priv->lock, flags);
    idx = le32_to_cpu(ring_control->host_idx[1]);
    i = idx % ARRAY_SIZE(ring_control->tx_data);
    + device_addr = ((struct p54_hdr *)skb->data)->req_id;

    mapping = pci_map_single(priv->pdev, skb->data, skb->len,
    PCI_DMA_TODEVICE);
    @@ -349,7 +351,7 @@ static void p54p_tx(struct ieee80211_hw

    desc = &ring_control->tx_data[i];
    desc->host_addr = cpu_to_le32(mapping);
    - desc->device_addr = ((struct p54_hdr *)skb->data)->req_id;
    + desc->device_addr = device_addr;
    desc->len = cpu_to_le16(skb->len);
    desc->flags = 0;


    \
     
     \ /
      Last update: 2020-11-09 14:43    [W:2.291 / U:0.140 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site