From patchwork Fri Oct 2 13:24:24 2015 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jiri Slaby X-Patchwork-Id: 54438 Return-Path: X-Original-To: linaro@patches.linaro.org Delivered-To: linaro@patches.linaro.org Received: from mail-la0-f71.google.com (mail-la0-f71.google.com [209.85.215.71]) by patches.linaro.org (Postfix) with ESMTPS id D106723009 for ; Fri, 2 Oct 2015 13:51:22 +0000 (UTC) Received: by labjk1 with SMTP id jk1sf48720311lab.0 for ; Fri, 02 Oct 2015 06:51:21 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:delivered-to:from:to:cc:subject :date:message-id:in-reply-to:references:in-reply-to:references :sender:precedence:list-id:x-original-sender :x-original-authentication-results:mailing-list:list-post:list-help :list-archive:list-unsubscribe; bh=ezqV+S3D+ebwsyQY9fjQgjFjQMQGK82RZmVlPOZoY+I=; b=Ka93AUYy4hsqstwActuan4m4tIY9fc1SNio3HsSMSESQYBBeesgErfiqGorRVSFyZB 8qs/Q5btpla7GlR58qbOidNDXipB8QNg+fN7dsBSpKE1KT7uBd0smqr+UBV6QjNPEiRv rbbQPVxk/Pj+1ft/eizWG5yIvjKOGmciCk6Gtm8GThNLM3v9yC0wnTfAsDhWWqueUFw4 gj5sRYxdr+r7+SSCI3GSlqkYGu3+LXk6bZLuolLglsvHj0Q1cDbUBgm4lriZr2vD/t+c 9LHn2u+5y76A3K7LfAJi5RW1nlTF2rJ9aEoQyoW4dI5QPZfkesOSeqRjqU2LEPzqWX+d EM+A== X-Gm-Message-State: ALoCoQnwhion49VCECTJkOsNPvfwAdk2SZ6V4kX7VemqW+M4KbzUsMfqMC/zxelAV5JxobKtnV0i X-Received: by 10.112.181.10 with SMTP id ds10mr1545525lbc.3.1443793881771; Fri, 02 Oct 2015 06:51:21 -0700 (PDT) MIME-Version: 1.0 X-BeenThere: patchwork-forward@linaro.org Received: by 10.25.148.143 with SMTP id w137ls201858lfd.105.gmail; Fri, 02 Oct 2015 06:51:21 -0700 (PDT) X-Received: by 10.112.134.102 with SMTP id pj6mr5740471lbb.14.1443793881639; Fri, 02 Oct 2015 06:51:21 -0700 (PDT) Received: from mail-la0-f41.google.com (mail-la0-f41.google.com. [209.85.215.41]) by mx.google.com with ESMTPS id y72si6307632lfd.85.2015.10.02.06.51.21 for (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Fri, 02 Oct 2015 06:51:21 -0700 (PDT) Received-SPF: pass (google.com: domain of patch+caf_=patchwork-forward=linaro.org@linaro.org designates 209.85.215.41 as permitted sender) client-ip=209.85.215.41; Received: by labzv5 with SMTP id zv5so93261323lab.1 for ; Fri, 02 Oct 2015 06:51:21 -0700 (PDT) X-Received: by 10.25.145.132 with SMTP id t126mr3624626lfd.88.1443793881477; Fri, 02 Oct 2015 06:51:21 -0700 (PDT) X-Forwarded-To: patchwork-forward@linaro.org X-Forwarded-For: patch@linaro.org patchwork-forward@linaro.org Delivered-To: patch@linaro.org Received: by 10.112.59.35 with SMTP id w3csp1258563lbq; Fri, 2 Oct 2015 06:51:20 -0700 (PDT) X-Received: by 10.68.247.106 with SMTP id yd10mr14229022pbc.105.1443793880139; Fri, 02 Oct 2015 06:51:20 -0700 (PDT) Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id k5si16904123pbq.227.2015.10.02.06.51.16; Fri, 02 Oct 2015 06:51:20 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753801AbbJBNvN (ORCPT + 30 others); Fri, 2 Oct 2015 09:51:13 -0400 Received: from mx2.suse.de ([195.135.220.15]:39543 "EHLO mx2.suse.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752901AbbJBNZi (ORCPT ); Fri, 2 Oct 2015 09:25:38 -0400 X-Virus-Scanned: by amavisd-new at test-mx.suse.de X-Amavis-Alert: BAD HEADER SECTION, Duplicate header field: "References" Received: from relay2.suse.de (charybdis-ext.suse.de [195.135.220.254]) by mx2.suse.de (Postfix) with ESMTP id 0C41AAD21; Fri, 2 Oct 2015 13:25:36 +0000 (UTC) From: Jiri Slaby To: stable@vger.kernel.org Cc: linux-kernel@vger.kernel.org, Kishon Vijay Abraham I , Felipe Balbi , Jiri Slaby Subject: [PATCH 3.12 19/84] usb: dwc3: ep0: Fix mem corruption on OUT transfers of more than 512 bytes Date: Fri, 2 Oct 2015 15:24:24 +0200 Message-Id: X-Mailer: git-send-email 2.6.0 In-Reply-To: <4386f737d429451d61358f771e315ed47e2f451f.1443792303.git.jslaby@suse.cz> References: <4386f737d429451d61358f771e315ed47e2f451f.1443792303.git.jslaby@suse.cz> In-Reply-To: References: Sender: linux-kernel-owner@vger.kernel.org Precedence: list List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-Removed-Original-Auth: Dkim didn't pass. X-Original-Sender: linux-kernel-owner@vger.kernel.org X-Original-Authentication-Results: mx.google.com; spf=pass (google.com: domain of patch+caf_=patchwork-forward=linaro.org@linaro.org designates 209.85.215.41 as permitted sender) smtp.mailfrom=patch+caf_=patchwork-forward=linaro.org@linaro.org Mailing-list: list patchwork-forward@linaro.org; contact patchwork-forward+owners@linaro.org X-Google-Group-Id: 836684582541 List-Post: , List-Help: , List-Archive: List-Unsubscribe: , From: Kishon Vijay Abraham I 3.12-stable review patch. If anyone has any objections, please let me know. =============== commit b2fb5b1a0f50d3ebc12342c8d8dead245e9c9d4e upstream. DWC3 uses bounce buffer to handle non max packet aligned OUT transfers and the size of bounce buffer is 512 bytes. However if the host initiates OUT transfers of size more than 512 bytes (and non max packet aligned), the driver throws a WARN dump but still programs the TRB to receive more than 512 bytes. This will cause bounce buffer to overflow and corrupt the adjacent memory locations which can be fatal. Fix it by programming the TRB to receive a maximum of DWC3_EP0_BOUNCE_SIZE (512) bytes. Signed-off-by: Kishon Vijay Abraham I Signed-off-by: Felipe Balbi Signed-off-by: Jiri Slaby --- drivers/usb/dwc3/ep0.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/drivers/usb/dwc3/ep0.c b/drivers/usb/dwc3/ep0.c index 657c51cf2109..fb78796b0c26 100644 --- a/drivers/usb/dwc3/ep0.c +++ b/drivers/usb/dwc3/ep0.c @@ -793,6 +793,11 @@ static void dwc3_ep0_complete_data(struct dwc3 *dwc, unsigned maxp = ep0->endpoint.maxpacket; transfer_size += (maxp - (transfer_size % maxp)); + + /* Maximum of DWC3_EP0_BOUNCE_SIZE can only be received */ + if (transfer_size > DWC3_EP0_BOUNCE_SIZE) + transfer_size = DWC3_EP0_BOUNCE_SIZE; + transferred = min_t(u32, ur->length, transfer_size - length); memcpy(ur->buf, dwc->ep0_bounce, transferred); @@ -905,11 +910,14 @@ static void __dwc3_ep0_do_control_data(struct dwc3 *dwc, return; } - WARN_ON(req->request.length > DWC3_EP0_BOUNCE_SIZE); - maxpacket = dep->endpoint.maxpacket; transfer_size = roundup(req->request.length, maxpacket); + if (transfer_size > DWC3_EP0_BOUNCE_SIZE) { + dev_WARN(dwc->dev, "bounce buf can't handle req len\n"); + transfer_size = DWC3_EP0_BOUNCE_SIZE; + } + dwc->ep0_bounced = true; /*