tx_prepare_skb() overrides buf[1].len to MT_CT_PARSE_LEN (72) for firmware header parsing, but dma_map_single() only maps skb_headlen(skb) bytes. When the SKB is shorter than 72 bytes, the hardware reads past the DMA-mapped region, causing SMMU translation faults on IOMMU-enabled systems. Cap the firmware parse length to the actual DMA-mapped length. Fixes: e90354e0452d ("mt76: mt7615: move core shared code in mt7615-common module") Cc: stable@vger.kernel.org Signed-off-by: Joshua Klinesmith --- drivers/net/wireless/mediatek/mt76/mt7615/pci_mac.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/wireless/mediatek/mt76/mt7615/pci_mac.c b/drivers/net/wireless/mediatek/mt76/mt7615/pci_mac.c index 53cb1eed1e4f..dc7128c46a72 100644 --- a/drivers/net/wireless/mediatek/mt76/mt7615/pci_mac.c +++ b/drivers/net/wireless/mediatek/mt76/mt7615/pci_mac.c @@ -35,7 +35,7 @@ mt7615_write_fw_txp(struct mt7615_dev *dev, struct mt76_tx_info *tx_info, /* pass partial skb header to fw */ tx_info->buf[0].len = MT_TXD_SIZE + sizeof(*txp); - tx_info->buf[1].len = MT_CT_PARSE_LEN; + tx_info->buf[1].len = min_t(u32, MT_CT_PARSE_LEN, tx_info->buf[1].len); tx_info->buf[1].skip_unmap = true; tx_info->nbuf = MT_CT_DMA_BUF_NUM; -- 2.43.0