From patchwork Thu Sep 17 08:45:51 2015 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jiri Slaby X-Patchwork-Id: 53780 Return-Path: X-Original-To: linaro@patches.linaro.org Delivered-To: linaro@patches.linaro.org Received: from mail-la0-f69.google.com (mail-la0-f69.google.com [209.85.215.69]) by patches.linaro.org (Postfix) with ESMTPS id B29B022A0D for ; Thu, 17 Sep 2015 08:46:44 +0000 (UTC) Received: by lanb10 with SMTP id b10sf4087742lan.3 for ; Thu, 17 Sep 2015 01:46:43 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:delivered-to:from:to:cc:subject :date:message-id:in-reply-to:references:sender:precedence:list-id :x-original-sender:x-original-authentication-results:mailing-list :list-post:list-help:list-archive:list-unsubscribe; bh=uK2Zn7837t+T/AZ8GYgkZuxYQJTaWfZJlyf8odnV66s=; b=DYs3fRiIqTQevmm32L4nCNMuzW1t8hsWFiitOfUNYSuP0tL8gS4p9EEuwNRvExCrVO Zg3HMBM1oGvrtBus4OKk645psWX/bYqdjC+anFCtsl3LVf8KlBACwGxjp3pIrEQZptmF AJnmo99CKaHXsANygnRwktPGqetizBFubrWUqYSTI5xbpSpwhj+vYaq0mSrNNihXR8+I I/FR64/K+E9Ys20P7DdJlnTpkotJRTEgWKYrCZy2l+8WOqumxTYG+qq/SKRmTp2FwpZG Oh9XDQbiwEmXWHxL2wtJb2bvVVhuLPhmcqXeDp5PZgbkvcZIhKMWPoDjpzsu2lA6ZE35 EoxA== X-Gm-Message-State: ALoCoQml4KtFOIWgxYFRPrQvQCYdPy3F7S2VbQqZ1QNkkPxbRs5rVNdzUlfYxGA1S3sgP6hE7pIL X-Received: by 10.112.144.99 with SMTP id sl3mr6300670lbb.12.1442479603721; Thu, 17 Sep 2015 01:46:43 -0700 (PDT) MIME-Version: 1.0 X-BeenThere: patchwork-forward@linaro.org Received: by 10.152.21.234 with SMTP id y10ls51608lae.62.gmail; Thu, 17 Sep 2015 01:46:43 -0700 (PDT) X-Received: by 10.112.63.67 with SMTP id e3mr17010062lbs.92.1442479603574; Thu, 17 Sep 2015 01:46:43 -0700 (PDT) Received: from mail-la0-f45.google.com (mail-la0-f45.google.com. [209.85.215.45]) by mx.google.com with ESMTPS id 5si1529391lai.67.2015.09.17.01.46.43 for (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Thu, 17 Sep 2015 01:46:43 -0700 (PDT) Received-SPF: pass (google.com: domain of patch+caf_=patchwork-forward=linaro.org@linaro.org designates 209.85.215.45 as permitted sender) client-ip=209.85.215.45; Received: by lamp12 with SMTP id p12so6722076lam.0 for ; Thu, 17 Sep 2015 01:46:43 -0700 (PDT) X-Received: by 10.112.64.72 with SMTP id m8mr27542763lbs.41.1442479603354; Thu, 17 Sep 2015 01:46:43 -0700 (PDT) X-Forwarded-To: patchwork-forward@linaro.org X-Forwarded-For: patch@linaro.org patchwork-forward@linaro.org Delivered-To: patch@linaro.org Received: by 10.112.59.35 with SMTP id w3csp2932185lbq; Thu, 17 Sep 2015 01:46:42 -0700 (PDT) X-Received: by 10.68.196.99 with SMTP id il3mr68870348pbc.166.1442479583610; Thu, 17 Sep 2015 01:46:23 -0700 (PDT) Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id tl9si3751911pab.62.2015.09.17.01.46.23; Thu, 17 Sep 2015 01:46:23 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of stable-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754185AbbIQIqW (ORCPT + 1 other); Thu, 17 Sep 2015 04:46:22 -0400 Received: from mx2.suse.de ([195.135.220.15]:48957 "EHLO mx2.suse.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754464AbbIQIqM (ORCPT ); Thu, 17 Sep 2015 04:46:12 -0400 X-Virus-Scanned: by amavisd-new at test-mx.suse.de Received: from relay1.suse.de (charybdis-ext.suse.de [195.135.220.254]) by mx2.suse.de (Postfix) with ESMTP id 14E7EAD39; Thu, 17 Sep 2015 08:46:06 +0000 (UTC) From: Jiri Slaby To: stable@vger.kernel.org Cc: Kishon Vijay Abraham I , Felipe Balbi , Jiri Slaby Subject: [patch added to the 3.12 stable tree] usb: dwc3: ep0: Fix mem corruption on OUT transfers of more than 512 bytes Date: Thu, 17 Sep 2015 10:45:51 +0200 Message-Id: <1442479556-16913-14-git-send-email-jslaby@suse.cz> X-Mailer: git-send-email 2.5.2 In-Reply-To: <1442479556-16913-1-git-send-email-jslaby@suse.cz> References: <1442479556-16913-1-git-send-email-jslaby@suse.cz> Sender: stable-owner@vger.kernel.org Precedence: list List-ID: X-Mailing-List: stable@vger.kernel.org X-Removed-Original-Auth: Dkim didn't pass. X-Original-Sender: patch@linaro.org X-Original-Authentication-Results: mx.google.com; spf=pass (google.com: domain of patch+caf_=patchwork-forward=linaro.org@linaro.org designates 209.85.215.45 as permitted sender) smtp.mailfrom=patch+caf_=patchwork-forward=linaro.org@linaro.org Mailing-list: list patchwork-forward@linaro.org; contact patchwork-forward+owners@linaro.org X-Google-Group-Id: 836684582541 List-Post: , List-Help: , List-Archive: List-Unsubscribe: , From: Kishon Vijay Abraham I This patch has been added to the 3.12 stable tree. If you have any objections, please let us know. =============== commit b2fb5b1a0f50d3ebc12342c8d8dead245e9c9d4e upstream. DWC3 uses bounce buffer to handle non max packet aligned OUT transfers and the size of bounce buffer is 512 bytes. However if the host initiates OUT transfers of size more than 512 bytes (and non max packet aligned), the driver throws a WARN dump but still programs the TRB to receive more than 512 bytes. This will cause bounce buffer to overflow and corrupt the adjacent memory locations which can be fatal. Fix it by programming the TRB to receive a maximum of DWC3_EP0_BOUNCE_SIZE (512) bytes. Signed-off-by: Kishon Vijay Abraham I Signed-off-by: Felipe Balbi Signed-off-by: Jiri Slaby --- drivers/usb/dwc3/ep0.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/drivers/usb/dwc3/ep0.c b/drivers/usb/dwc3/ep0.c index 657c51cf2109..fb78796b0c26 100644 --- a/drivers/usb/dwc3/ep0.c +++ b/drivers/usb/dwc3/ep0.c @@ -793,6 +793,11 @@ static void dwc3_ep0_complete_data(struct dwc3 *dwc, unsigned maxp = ep0->endpoint.maxpacket; transfer_size += (maxp - (transfer_size % maxp)); + + /* Maximum of DWC3_EP0_BOUNCE_SIZE can only be received */ + if (transfer_size > DWC3_EP0_BOUNCE_SIZE) + transfer_size = DWC3_EP0_BOUNCE_SIZE; + transferred = min_t(u32, ur->length, transfer_size - length); memcpy(ur->buf, dwc->ep0_bounce, transferred); @@ -905,11 +910,14 @@ static void __dwc3_ep0_do_control_data(struct dwc3 *dwc, return; } - WARN_ON(req->request.length > DWC3_EP0_BOUNCE_SIZE); - maxpacket = dep->endpoint.maxpacket; transfer_size = roundup(req->request.length, maxpacket); + if (transfer_size > DWC3_EP0_BOUNCE_SIZE) { + dev_WARN(dwc->dev, "bounce buf can't handle req len\n"); + transfer_size = DWC3_EP0_BOUNCE_SIZE; + } + dwc->ep0_bounced = true; /*