qcacld-3.0: Kernel crash as incorrect DMA buffer size
When HTT attached, driver allocates DMA buffer to record each RX ring entry, with element size - target_paddr_t, which is bus size, and may be different from kernel's physical address size. While in htt_rx_detach, size of qdf_dma_addr_t used for buffer free. In case kernel built as 64-bit, and bus size as default 32-bit, it will crash when free. Use same element size to avoid it. CRs-Fixed: 2087592 Change-Id: Iabe95f92ea82b736213a8b81453163229b2a3a3b
此提交包含在:
@@ -699,7 +699,7 @@ void htt_rx_detach(struct htt_pdev_t *pdev)
|
||||
memctx));
|
||||
|
||||
qdf_mem_free_consistent(pdev->osdev, pdev->osdev->dev,
|
||||
pdev->rx_ring.size * sizeof(qdf_dma_addr_t),
|
||||
pdev->rx_ring.size * sizeof(target_paddr_t),
|
||||
pdev->rx_ring.buf.paddrs_ring,
|
||||
pdev->rx_ring.base_paddr,
|
||||
qdf_get_dma_mem_context((&pdev->rx_ring.buf),
|
||||
|
新增問題並參考
封鎖使用者