aboutsummaryrefslogtreecommitdiffstats
path: root/drivers
diff options
context:
space:
mode:
authorBruno Randolf <br1@einfach.org>2010-05-18 21:18:16 -0400
committerJohn W. Linville <linville@tuxdriver.com>2010-05-24 14:59:23 -0400
commitb5eae9ff5ba6d76de19286dd6429acd7cde3f79d (patch)
treeae0b5356f8f016854bd2379dfc5baabffd7b3e63 /drivers
parent579d7534ca83235794b6d9ef3cd473ffc14e9d42 (diff)
ath5k: consistently use rx_bufsize for RX DMA
We should use the same buffer size we set up for DMA also in the hardware descriptor. Previously we used common->rx_bufsize for setting up the DMA mapping, but used skb_tailroom(skb) for the size we tell to the hardware in the descriptor itself. The problem is that skb_tailroom(skb) can give us a larger value than the size we set up for DMA before. This allows the hardware to write into memory locations not set up for DMA. In practice this should rarely happen because all packets should be smaller than the maximum 802.11 packet size. On the tested platform rx_bufsize is 2528, and we allocated an skb of 2559 bytes length (including padding for cache alignment) but sbk_tailroom() was 2592. Just consistently use rx_bufsize for all RX DMA memory sizes. Also use the return value of the descriptor setup function. Cc: stable@kernel.org Signed-off-by: Bruno Randolf <br1@einfach.org> Reviewed-by: Luis R. Rodriguez <lrodriguez@atheros.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
Diffstat (limited to 'drivers')
-rw-r--r--drivers/net/wireless/ath/ath5k/base.c7
1 files changed, 4 insertions, 3 deletions
diff --git a/drivers/net/wireless/ath/ath5k/base.c b/drivers/net/wireless/ath/ath5k/base.c
index 5f04cf38a5bc..cc6d41dec332 100644
--- a/drivers/net/wireless/ath/ath5k/base.c
+++ b/drivers/net/wireless/ath/ath5k/base.c
@@ -1214,6 +1214,7 @@ ath5k_rxbuf_setup(struct ath5k_softc *sc, struct ath5k_buf *bf)
1214 struct ath5k_hw *ah = sc->ah; 1214 struct ath5k_hw *ah = sc->ah;
1215 struct sk_buff *skb = bf->skb; 1215 struct sk_buff *skb = bf->skb;
1216 struct ath5k_desc *ds; 1216 struct ath5k_desc *ds;
1217 int ret;
1217 1218
1218 if (!skb) { 1219 if (!skb) {
1219 skb = ath5k_rx_skb_alloc(sc, &bf->skbaddr); 1220 skb = ath5k_rx_skb_alloc(sc, &bf->skbaddr);
@@ -1240,9 +1241,9 @@ ath5k_rxbuf_setup(struct ath5k_softc *sc, struct ath5k_buf *bf)
1240 ds = bf->desc; 1241 ds = bf->desc;
1241 ds->ds_link = bf->daddr; /* link to self */ 1242 ds->ds_link = bf->daddr; /* link to self */
1242 ds->ds_data = bf->skbaddr; 1243 ds->ds_data = bf->skbaddr;
1243 ah->ah_setup_rx_desc(ah, ds, 1244 ret = ah->ah_setup_rx_desc(ah, ds, ah->common.rx_bufsize, 0);
1244 skb_tailroom(skb), /* buffer size */ 1245 if (ret)
1245 0); 1246 return ret;
1246 1247
1247 if (sc->rxlink != NULL) 1248 if (sc->rxlink != NULL)
1248 *sc->rxlink = bf->daddr; 1249 *sc->rxlink = bf->daddr;