lkml.org 
[lkml]   [2021]   [May]   [12]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.11 060/601] mt76: fix potential DMA mapping leak
    Date
    From: Felix Fietkau <nbd@nbd.name>

    commit b4403cee6400c5f679e9c4a82b91d61aa961eccf upstream.

    With buf uninitialized in mt76_dma_tx_queue_skb_raw, its field skip_unmap
    could potentially inherit a non-zero value from stack garbage.
    If this happens, it will cause DMA mappings for MCU command frames to not be
    unmapped after completion

    Fixes: 27d5c528a7ca ("mt76: fix double DMA unmap of the first buffer on 7615/7915")
    Cc: stable@vger.kernel.org
    Signed-off-by: Felix Fietkau <nbd@nbd.name>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    drivers/net/wireless/mediatek/mt76/dma.c | 2 +-
    1 file changed, 1 insertion(+), 1 deletion(-)

    --- a/drivers/net/wireless/mediatek/mt76/dma.c
    +++ b/drivers/net/wireless/mediatek/mt76/dma.c
    @@ -309,7 +309,7 @@ static int
    mt76_dma_tx_queue_skb_raw(struct mt76_dev *dev, struct mt76_queue *q,
    struct sk_buff *skb, u32 tx_info)
    {
    - struct mt76_queue_buf buf;
    + struct mt76_queue_buf buf = {};
    dma_addr_t addr;

    if (q->queued + 1 >= q->ndesc - 1)

    \
     
     \ /
      Last update: 2021-05-12 19:01    [W:2.884 / U:0.604 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site