Commit c48c0fd0 authored by Thomas Fourier's avatar Thomas Fourier Committed by Takashi Sakamoto
Browse files

firewire: nosy: Fix dma_free_coherent() size 



It looks like the buffer allocated and mapped in add_card() is done
with size RCV_BUFFER_SIZE which is 16 KB and 4KB.

Fixes: 28646821 ("firewire: new driver: nosy - IEEE 1394 traffic sniffer")
Co-developed-by: default avatarThomas Fourier <fourier.thomas@gmail.com>
Signed-off-by: default avatarThomas Fourier <fourier.thomas@gmail.com>
Co-developed-by: default avatarChristophe JAILLET <christophe.jaillet@wanadoo.fr>
Signed-off-by: default avatarChristophe JAILLET <christophe.jaillet@wanadoo.fr>
Link: https://lore.kernel.org/r/20251216165420.38355-2-fourier.thomas@gmail.com


Signed-off-by: default avatarTakashi Sakamoto <o-takashi@sakamocchi.jp>
parent 9448598b

drivers/firewire/nosy.c

+5 −5
Original line number Diff line number Diff line
@@ -36,6 +36,8 @@ 


static char driver_name[] = KBUILD_MODNAME;



#define RCV_BUFFER_SIZE (16 * 1024)



/* this is the physical layout of a PCL, its size is 128 bytes */

struct pcl {

	__le32 next;
@@ -517,16 +519,14 @@ remove_card(struct pci_dev *dev) 
			  lynx->rcv_start_pcl, lynx->rcv_start_pcl_bus);

	dma_free_coherent(&lynx->pci_device->dev, sizeof(struct pcl),

			  lynx->rcv_pcl, lynx->rcv_pcl_bus);

	dma_free_coherent(&lynx->pci_device->dev, PAGE_SIZE, lynx->rcv_buffer,

			  lynx->rcv_buffer_bus);

	dma_free_coherent(&lynx->pci_device->dev, RCV_BUFFER_SIZE,

			  lynx->rcv_buffer, lynx->rcv_buffer_bus);



	iounmap(lynx->registers);

	pci_disable_device(dev);

	lynx_put(lynx);

}



#define RCV_BUFFER_SIZE (16 * 1024)



static int

add_card(struct pci_dev *dev, const struct pci_device_id *unused)

{
@@ -680,7 +680,7 @@ add_card(struct pci_dev *dev, const struct pci_device_id *unused) 
		dma_free_coherent(&lynx->pci_device->dev, sizeof(struct pcl),

				  lynx->rcv_pcl, lynx->rcv_pcl_bus);

	if (lynx->rcv_buffer)

		dma_free_coherent(&lynx->pci_device->dev, PAGE_SIZE,

		dma_free_coherent(&lynx->pci_device->dev, RCV_BUFFER_SIZE,

				  lynx->rcv_buffer, lynx->rcv_buffer_bus);

	iounmap(lynx->registers);