staging: rtl8192e: rtl92e_fill_tx_desc fix write to mapped out memory.

commit baabd567f87be05330faa5140f72a91960e7405a upstream.

The driver attempts to alter memory that is mapped to PCI device.

This is because tx_fwinfo_8190pci points to skb->data

Move the pci_map_single to when completed buffer is ready to be mapped with
psdec is empty to drop on mapping error.

Signed-off-by: Malcolm Priestley <tvboxspy@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

1 files changed, 9 insertions, 4 deletions

diff --git a/drivers/staging/rtl8192e/rtl8192e/r8192E_dev.c b/drivers/staging/rtl8192e/rtl8192e/r8192E_dev.c
index 8d6bca61e7aa..fa1440e15382 100644
--- a/drivers/staging/rtl8192e/rtl8192e/r8192E_dev.c
+++ b/drivers/staging/rtl8192e/rtl8192e/r8192E_dev.c
@@ -1184,8 +1184,7 @@ void  rtl92e_fill_tx_desc(struct net_device *dev, struct tx_desc *pdesc,
                           struct cb_desc *cb_desc, struct sk_buff *skb)
 {
         struct r8192_priv *priv = rtllib_priv(dev);
-        dma_addr_t mapping = pci_map_single(priv->pdev, skb->data, skb->len,
-                         PCI_DMA_TODEVICE);
+        dma_addr_t mapping;
         struct tx_fwinfo_8190pci *pTxFwInfo;
 
         pTxFwInfo = (struct tx_fwinfo_8190pci *)skb->data;
@@ -1196,8 +1195,6 @@ void  rtl92e_fill_tx_desc(struct net_device *dev, struct tx_desc *pdesc,
         pTxFwInfo->Short = _rtl92e_query_is_short(pTxFwInfo->TxHT,
                                                   pTxFwInfo->TxRate, cb_desc);
 
-        if (pci_dma_mapping_error(priv->pdev, mapping))
-                netdev_err(dev, "%s(): DMA Mapping error\n", __func__);
         if (cb_desc->bAMPDUEnable) {
                 pTxFwInfo->AllowAggregation = 1;
                 pTxFwInfo->RxMF = cb_desc->ampdu_factor;
@@ -1232,6 +1229,14 @@ void  rtl92e_fill_tx_desc(struct net_device *dev, struct tx_desc *pdesc,
         }
 
         memset((u8 *)pdesc, 0, 12);
+
+        mapping = pci_map_single(priv->pdev, skb->data, skb->len,
+                                 PCI_DMA_TODEVICE);
+        if (pci_dma_mapping_error(priv->pdev, mapping)) {
+                netdev_err(dev, "%s(): DMA Mapping error\n", __func__);
+                return;
+        }
+
         pdesc->LINIP = 0;
         pdesc->CmdInit = 1;
         pdesc->Offset = sizeof(struct tx_fwinfo_8190pci) + 8;