[PATCH net] net: korina: fix dma_unmap_single() length in korina_rx()

[Thomas Fourier]

dma_map_single() is called with size KORINA_RBSIZE and
dma_unmap_single() is called with size pkt_len which might be smaller.
Therefore, parts of the buffer may stay mapped after dma_unmap_single()
is called, which leaks a resource and might leave exposed mapped memory
that might be eventually freed.

Change dma_unmap_single() length to KORINA_RBSIZE.

Fixes: 0fc96939a97f ("net: korina: Use DMA API")
Cc: <stable@xxxxxxxxxxxxxxx>
Signed-off-by: Thomas Fourier <fourier.thomas@xxxxxxxxx>
---
 drivers/net/ethernet/korina.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/korina.c b/drivers/net/ethernet/korina.c
index 891a94d89f4b..fac3d3d3e5d7 100644
--- a/drivers/net/ethernet/korina.c
+++ b/drivers/net/ethernet/korina.c
@@ -649,7 +649,7 @@ static int korina_rx(struct net_device *dev, int limit)
 
 		pkt_len = RCVPKT_LENGTH(devcs);
 		dma_unmap_single(lp->dmadev, lp->rx_skb_dma[lp->rx_next_done],
-				 pkt_len, DMA_FROM_DEVICE);
+				 KORINA_RBSIZE, DMA_FROM_DEVICE);
 
 		/* Do not count the CRC */
 		skb_put(skb, pkt_len - 4);
-- 
2.43.0