• Chin-Ran Lo's avatar
    mwifiex: fix tx_info/rx_info overlap with PCIe dma_mapping · bca463e8
    Chin-Ran Lo authored
    On PCIe Tx data path, network interface specific tx_info
    parameters such as bss_num and bss_type are saved at
    "skb->cb + sizeof(dma_addr_t)" (returned by MWIFIEX_SKB_TXCB).
    Later mwifiex_map_pci_memory() called from
    mwifiex_pcie_send_data() will memcpy
    sizeof(struct mwifiex_dma_mapping) bytes to save PCIe DMA
    address and length information at beginning of skb->cb.
    This accidently overwrites bss_num and bss_type saved in skb->cb
    previously because bss_num/bss_type and mwifiex_dma_mapping data
    overlap.
    Similarly, on PCIe Rx data path, rx_info parameters overlaps
    with PCIe DMA address and length information too.
    
    Fix it by defining mwifiex_cb structure and having
    MWIFIEX_SKB_TXCB and MWIFIEX_SKB_RXCB return the correct address
    of tx_info/rx_info using the structure members.
    
    Also add a BUILD_BUG_ON to maks sure that mwifiex_cb structure
    doesn't exceed the size of skb->cb.
    Reviewed-by: default avatarAaron Durbin <adurbin@chromium.org>
    Signed-off-by: default avatarChin-Ran Lo <crlo@marvell.com>
    Signed-off-by: default avatarBing Zhao <bzhao@marvell.com>
    Signed-off-by: default avatarJohn W. Linville <linville@tuxdriver.com>
    bca463e8
pcie.c 64.2 KB