iwlwifi: mvm: unmap the paging memory before freeing it

This led to a DMA splat.

Fixes: a6c4fb4441f4 ("iwlwifi: mvm: Add FW paging mechanism for the UMAC on PCI")
Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>

diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
index 4db1d84..4c16fa7 100644 (file)
--- a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c
@@ -160,17 +160,21 @@ void iwl_free_fw_paging(struct iwl_mvm *mvm)
                return;
 
        for (i = 0; i < NUM_OF_FW_PAGING_BLOCKS; i++) {
-               if (!mvm->fw_paging_db[i].fw_paging_block) {
+               struct iwl_fw_paging *paging = &mvm->fw_paging_db[i];
+
+               if (!paging->fw_paging_block) {
                        IWL_DEBUG_FW(mvm,
                                     "Paging: block %d already freed, continue to next page\n",
                                     i);
 
                        continue;
                }
+               dma_unmap_page(mvm->trans->dev, paging->fw_paging_phys,
+                              paging->fw_paging_size, DMA_BIDIRECTIONAL);
 
-               __free_pages(mvm->fw_paging_db[i].fw_paging_block,
-                            get_order(mvm->fw_paging_db[i].fw_paging_size));
-               mvm->fw_paging_db[i].fw_paging_block = NULL;
+               __free_pages(paging->fw_paging_block,
+                            get_order(paging->fw_paging_size));
+               paging->fw_paging_block = NULL;
        }
        kfree(mvm->trans->paging_download_buf);
        mvm->trans->paging_download_buf = NULL;