From: Meenakshi Venkataraman <meenakshi.venkataraman@xxxxxxxxx> The driver can potentially unmap pages that have not been mapped yet. Fix this race condition. Cc: stable@xxxxxxxxxxxxxxx Reported-by: Emmanuel Grumbach <emmanuel.grumbach@xxxxxxxxx> Signed-off-by: Meenakshi Venkataraman <meenakshi.venkataraman@xxxxxxxxx> Signed-off-by: Wey-Yi Guy <wey-yi.w.guy@xxxxxxxxx> --- this patch will be also available from wireless branch on git://git.kernel.org/pub/scm/linux/kernel/git/iwlwifi/iwlwifi.git drivers/net/wireless/iwlwifi/iwl-trans-pcie-rx.c | 4 +++- 1 files changed, 3 insertions(+), 1 deletions(-) diff --git a/drivers/net/wireless/iwlwifi/iwl-trans-pcie-rx.c b/drivers/net/wireless/iwlwifi/iwl-trans-pcie-rx.c index aa7aea1..173275f 100644 --- a/drivers/net/wireless/iwlwifi/iwl-trans-pcie-rx.c +++ b/drivers/net/wireless/iwlwifi/iwl-trans-pcie-rx.c @@ -310,7 +310,6 @@ static void iwlagn_rx_allocate(struct iwl_trans *trans, gfp_t priority) spin_unlock_irqrestore(&rxq->lock, flags); BUG_ON(rxb->page); - rxb->page = page; /* Get physical address of the RB */ rxb->page_dma = dma_map_page(trans->dev, page, 0, PAGE_SIZE << hw_params(trans).rx_page_order, @@ -320,6 +319,9 @@ static void iwlagn_rx_allocate(struct iwl_trans *trans, gfp_t priority) /* and also 256 byte aligned! */ BUG_ON(rxb->page_dma & DMA_BIT_MASK(8)); + /* Page *must* be mapped before before updating the rxb. */ + rxb->page = page; + spin_lock_irqsave(&rxq->lock, flags); list_add_tail(&rxb->list, &rxq->rx_free); -- 1.7.0.4 -- To unsubscribe from this list: send the line "unsubscribe linux-wireless" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
