This is a note to let you know that I've just added the patch titled iwlwifi: mvm: unmap the paging memory before freeing it to the 4.7-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: iwlwifi-mvm-unmap-the-paging-memory-before-freeing-it.patch and it can be found in the queue-4.7 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable@xxxxxxxxxxxxxxx> know about it. >From 3edbc7dabab8ce85aa75c5e290ecda7a3692ebc9 Mon Sep 17 00:00:00 2001 From: Emmanuel Grumbach <emmanuel.grumbach@xxxxxxxxx> Date: Sun, 19 Jun 2016 20:57:02 +0300 Subject: iwlwifi: mvm: unmap the paging memory before freeing it From: Emmanuel Grumbach <emmanuel.grumbach@xxxxxxxxx> commit 3edbc7dabab8ce85aa75c5e290ecda7a3692ebc9 upstream. This led to a DMA splat. Fixes: a6c4fb4441f4 ("iwlwifi: mvm: Add FW paging mechanism for the UMAC on PCI") Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@xxxxxxxxx> Signed-off-by: Luca Coelho <luciano.coelho@xxxxxxxxx> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> --- drivers/net/wireless/intel/iwlwifi/mvm/fw.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) --- a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c +++ b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c @@ -139,17 +139,21 @@ void iwl_free_fw_paging(struct iwl_mvm * return; for (i = 0; i < NUM_OF_FW_PAGING_BLOCKS; i++) { - if (!mvm->fw_paging_db[i].fw_paging_block) { + struct iwl_fw_paging *paging = &mvm->fw_paging_db[i]; + + if (!paging->fw_paging_block) { IWL_DEBUG_FW(mvm, "Paging: block %d already freed, continue to next page\n", i); continue; } + dma_unmap_page(mvm->trans->dev, paging->fw_paging_phys, + paging->fw_paging_size, DMA_BIDIRECTIONAL); - __free_pages(mvm->fw_paging_db[i].fw_paging_block, - get_order(mvm->fw_paging_db[i].fw_paging_size)); - mvm->fw_paging_db[i].fw_paging_block = NULL; + __free_pages(paging->fw_paging_block, + get_order(paging->fw_paging_size)); + paging->fw_paging_block = NULL; } kfree(mvm->trans->paging_download_buf); mvm->trans->paging_download_buf = NULL; Patches currently in stable-queue which might be from emmanuel.grumbach@xxxxxxxxx are queue-4.7/iwlwifi-mvm-unmap-the-paging-memory-before-freeing-it.patch queue-4.7/iwlwifi-mvm-don-t-use-ret-when-not-initialised.patch -- To unsubscribe from this list: send the line "unsubscribe stable" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html