iwlwifi: unmap memory before use
Handling responses to driver originated commands include passing the
original command buffer to the caller. At this time it is possible for a
callback to be invoked that is passed this command buffer and thus likely
to access it.
We need to make sure that the memory associated with that buffer is not DMA
mapped at the time.
Signed-off-by: Reinette Chatre <reinette.chatre@intel.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
diff --git a/drivers/net/wireless/iwlwifi/iwl-tx.c b/drivers/net/wireless/iwlwifi/iwl-tx.c
index 8ae4c9b..b46967f 100644
--- a/drivers/net/wireless/iwlwifi/iwl-tx.c
+++ b/drivers/net/wireless/iwlwifi/iwl-tx.c
@@ -1121,11 +1121,6 @@
return;
}
- pci_unmap_single(priv->pci_dev,
- pci_unmap_addr(&txq->meta[cmd_idx], mapping),
- pci_unmap_len(&txq->meta[cmd_idx], len),
- PCI_DMA_BIDIRECTIONAL);
-
for (idx = iwl_queue_inc_wrap(idx, q->n_bd); q->read_ptr != idx;
q->read_ptr = iwl_queue_inc_wrap(q->read_ptr, q->n_bd)) {
@@ -1173,6 +1168,11 @@
cmd = priv->txq[IWL_CMD_QUEUE_NUM].cmd[cmd_index];
meta = &priv->txq[IWL_CMD_QUEUE_NUM].meta[cmd_index];
+ pci_unmap_single(priv->pci_dev,
+ pci_unmap_addr(meta, mapping),
+ pci_unmap_len(meta, len),
+ PCI_DMA_BIDIRECTIONAL);
+
/* Input error checking is done when commands are added to queue. */
if (meta->flags & CMD_WANT_SKB) {
meta->source->reply_page = (unsigned long)rxb_addr(rxb);