Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1228591
| From | Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
|---|---|
| Newsgroups | linux.kernel |
| Subject | [PATCH 4.1 058/102] usb: dwc3: ep0: Fix mem corruption on OUT transfers of more than 512 bytes |
| Date | 2015-09-19 20:00 +0200 |
| Message-ID | <qauAC-7T-129@gated-at.bofh.it> (permalink) |
| References | <qau7v-80f-7@gated-at.bofh.it> |
| Organization | linux.* mail to news gateway |
4.1-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kishon Vijay Abraham I <kishon@ti.com>
commit b2fb5b1a0f50d3ebc12342c8d8dead245e9c9d4e upstream.
DWC3 uses bounce buffer to handle non max packet aligned OUT transfers and
the size of bounce buffer is 512 bytes. However if the host initiates OUT
transfers of size more than 512 bytes (and non max packet aligned), the
driver throws a WARN dump but still programs the TRB to receive more than
512 bytes. This will cause bounce buffer to overflow and corrupt the
adjacent memory locations which can be fatal.
Fix it by programming the TRB to receive a maximum of DWC3_EP0_BOUNCE_SIZE
(512) bytes.
Signed-off-by: Kishon Vijay Abraham I <kishon@ti.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/dwc3/ep0.c | 12 ++++++++++--
1 file changed, 10 insertions(+), 2 deletions(-)
--- a/drivers/usb/dwc3/ep0.c
+++ b/drivers/usb/dwc3/ep0.c
@@ -820,6 +820,11 @@ static void dwc3_ep0_complete_data(struc
unsigned maxp = ep0->endpoint.maxpacket;
transfer_size += (maxp - (transfer_size % maxp));
+
+ /* Maximum of DWC3_EP0_BOUNCE_SIZE can only be received */
+ if (transfer_size > DWC3_EP0_BOUNCE_SIZE)
+ transfer_size = DWC3_EP0_BOUNCE_SIZE;
+
transferred = min_t(u32, ur->length,
transfer_size - length);
memcpy(ur->buf, dwc->ep0_bounce, transferred);
@@ -941,11 +946,14 @@ static void __dwc3_ep0_do_control_data(s
return;
}
- WARN_ON(req->request.length > DWC3_EP0_BOUNCE_SIZE);
-
maxpacket = dep->endpoint.maxpacket;
transfer_size = roundup(req->request.length, maxpacket);
+ if (transfer_size > DWC3_EP0_BOUNCE_SIZE) {
+ dev_WARN(dwc->dev, "bounce buf can't handle req len\n");
+ transfer_size = DWC3_EP0_BOUNCE_SIZE;
+ }
+
dwc->ep0_bounced = true;
/*
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
[PATCH 4.1 000/102] 4.1.8-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-19 19:40 +0200
[PATCH 4.1 055/102] xfs: Fix file type directory corruption for btree directories Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-19 19:40 +0200
[PATCH 4.1 046/102] spi: img-spfi: fix multiple calls to request gpio Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-19 19:40 +0200
[PATCH 4.1 057/102] doc: usb: gadget-testing: using the updated testusb.c Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-19 20:00 +0200
[PATCH 4.1 059/102] usb: gadget: f_uac2: finalize wMaxPacketSize according to bandwidth Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-19 20:00 +0200
[PATCH 4.1 058/102] usb: dwc3: ep0: Fix mem corruption on OUT transfers of more than 512 bytes Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-19 20:00 +0200
[PATCH 4.1 056/102] usb: gadget: m66592-udc: forever loop in set_feature() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-19 20:00 +0200
[PATCH 4.1 100/102] fs: Set the size of empty dirs to 0. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-19 20:20 +0200
[PATCH 4.1 025/102] staging: comedi: adl_pci7x3x: fix digital output on PCI-7230 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-19 20:20 +0200
[PATCH 4.1 096/102] ARM: rockchip: fix the CPU soft reset Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-19 20:20 +0200
[PATCH 4.1 095/102] ARM: OMAP2+: DRA7: clockdomain: change l4per2_7xx_clkdm to SW_WKUP Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-19 20:20 +0200
[PATCH 4.1 101/102] hpfs: update ctime and mtime on directory modification Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-19 20:20 +0200
[PATCH 4.1 099/102] drivercore: Fix unregistration path of platform devices Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-19 20:20 +0200
[PATCH 4.1 092/102] of/address: Dont loop forever in of_find_matching_node_by_address(). Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-19 20:20 +0200
[PATCH 4.1 060/102] usb: host: ehci-sys: delete useless bus_to_hcd conversion Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-19 20:20 +0200
[PATCH 4.1 098/102] ACPI, PCI: Penalize legacy IRQ used by ACPI SCI Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-19 20:20 +0200
[PATCH 4.1 091/102] soc/tegra: pmc: Avoid usage of uninitialized variable Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-19 20:20 +0200
[PATCH 4.1 094/102] ARM: dts: fix clock-frequency of display timing0 for exynos3250-rinato Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-19 20:20 +0200
[PATCH 4.1 097/102] ARM: dts: rockchip: fix rk3288 watchdog irq Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-19 20:20 +0200
[PATCH 4.1 064/102] ASoC: adav80x: Remove .read_flag_mask setting from adav80x_regmap_config Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-19 20:20 +0200
[PATCH 4.1 102/102] fs: create and use seq_show_option for escaping Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-19 20:20 +0200
[PATCH 4.1 069/102] serial: 8250_pci: Add support for Pericom PI7C9X795[1248] Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-19 20:20 +0200
[PATCH 4.1 089/102] regulator: pbias: Fix broken pbias disable functionality Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-19 20:20 +0200
[PATCH 4.1 066/102] ASoC: arizona: Poll for FLL clock OK rather than use interrupts Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-19 20:20 +0200
[PATCH 4.1 067/102] serial: 8250: dont bind to SMSC IrCC IR port Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-19 20:20 +0200
[PATCH 4.1 063/102] ASoC: samsung: Remove redundant arndale_audio_remove Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-19 20:20 +0200
[PATCH 4.1 090/102] x86/mce: Reenable CMCI banks when swiching back to interrupt mode Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-19 20:20 +0200
[PATCH 4.1 068/102] serial: 8250: bind to ALi Fast Infrared Controller (ALI5123) Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-19 20:20 +0200
[PATCH 4.1 093/102] ARM: orion5x: fix legacy orion5x IRQ numbers Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-19 20:20 +0200
[PATCH 4.1 020/102] iio: industrialio-buffer: Fix iio_buffer_poll return value Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-19 20:30 +0200
[PATCH 4.1 087/102] spi/spi-xilinx: Fix mixed poll/irq mode Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-19 20:30 +0200
[PATCH 4.1 011/102] drm/i915: Preserve SSC earlier Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-19 20:30 +0200
[PATCH 4.1 088/102] auxdisplay: ks0108: fix refcount Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-19 20:30 +0200
[PATCH 4.1 061/102] tty: serial: men_z135_uart.c: Fix race between IRQ and set_termios() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-19 20:30 +0200
[PATCH 4.1 030/102] clk: exynos4: Fix wrong clock for Exynos4x12 ADC Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-19 20:30 +0200
[PATCH 4.1 004/102] x86/ldt: Further fix FPU emulation Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-19 20:30 +0200
[PATCH 4.1 073/102] crypto: ghash-clmulni: specify context size for ghash async algorithm Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-19 20:30 +0200
[PATCH 4.1 085/102] Doc: ABI: testing: configfs-usb-gadget-sourcesink Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-19 20:30 +0200
[PATCH 4.1 019/102] iio: event: Remove negative error code from iio_event_poll Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-19 20:30 +0200
[PATCH 4.1 078/102] KVM: PPC: Book3S HV: Exit on H_DOORBELL if HOST_IPI is set Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-19 20:30 +0200
[PATCH 4.1 072/102] crypto: vmx - Fixing GHASH Key issue on little endian Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-19 20:30 +0200
[PATCH 4.1 084/102] Doc: ABI: testing: configfs-usb-gadget-loopback Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-19 20:30 +0200
[PATCH 4.1 079/102] KVM: PPC: Book3S HV: Fix race in reading change bit when removing HPTE Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-19 20:30 +0200
[PATCH 4.1 026/102] staging: comedi: usbduxsigma: dont clobber ai_timer in command test Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-19 20:30 +0200
[PATCH 4.1 010/102] drm/radeon: fix HDMI quantization_range for pre-DCE5 asics Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-19 20:30 +0200
[PATCH 4.1 082/102] xtensa: fix kernel register spilling Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-19 20:30 +0200
[PATCH 4.1 077/102] KVM: MMU: fix validation of mmio page fault Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-19 20:30 +0200
[PATCH 4.1 075/102] HID: cp2112: fix byte order in SMBUS operations Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-19 20:30 +0200
[PATCH 4.1 029/102] clk: rockchip: rk3288: add CLK_SET_RATE_PARENT to sclk_mac Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-19 20:30 +0200
[PATCH 4.1 086/102] spi/spi-xilinx: Fix spurious IRQ ACK on irq mode Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-19 20:30 +0200
[PATCH 4.1 062/102] ASoC: rt5640: fix line out no sound issue Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-19 20:30 +0200
[PATCH 4.1 081/102] xtensa: fix threadptr reload on return to userspace Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-19 20:30 +0200
[PATCH 4.1 021/102] iio: adis16400: Fix adis16448 gyroscope scale Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-19 20:30 +0200
[PATCH 4.1 070/102] serial: samsung: fix DMA mode enter condition for small FIFO sizes Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-19 20:30 +0200
[PATCH 4.1 071/102] serial: samsung: fix DMA for FIFO smaller than cache line size Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-19 20:30 +0200
[PATCH 4.1 018/102] iio: bmg160: IIO_BUFFER and IIO_TRIGGERED_BUFFER are required Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-19 20:30 +0200
[PATCH 4.1 083/102] devres: fix devres_get() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-19 20:30 +0200
[PATCH 4.1 028/102] PM / clk: dont return int on __pm_clk_enable() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-19 20:30 +0200
[PATCH 4.1 076/102] HID: cp2112: fix I2C_SMBUS_BYTE write Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-19 20:30 +0200
[PATCH 4.1 080/102] KVM: x86: Use adjustment in guest cycles when handling MSR_IA32_TSC_ADJUST Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-19 20:30 +0200
[PATCH 4.1 002/102] x86/ldt: Correct LDT access in single stepping logic Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-19 20:30 +0200
[PATCH 4.1 003/102] x86/ldt: Correct FPU emulation access to LDT Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-19 20:30 +0200
[PATCH 4.1 017/102] s390/setup: fix novx parameter Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-19 20:40 +0200
[PATCH 4.1 016/102] s390/sclp: fix compile error Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-19 20:40 +0200
[PATCH 4.1 012/102] drm/qxl: validate monitors config modes Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-19 20:40 +0200
Re: [PATCH 4.1 000/102] 4.1.8-stable review Guenter Roeck <linux@roeck-us.net> - 2015-09-19 22:40 +0200
Re: [PATCH 4.1 000/102] 4.1.8-stable review Guenter Roeck <linux@roeck-us.net> - 2015-09-20 02:30 +0200
Re: [PATCH 4.1 000/102] 4.1.8-stable review Willy Tarreau <w@1wt.eu> - 2015-09-20 07:30 +0200
Re: [PATCH 4.1 000/102] 4.1.8-stable review Sudip Mukherjee <sudipm.mukherjee@gmail.com> - 2015-09-20 10:00 +0200
Re: [PATCH 4.1 000/102] 4.1.8-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-21 06:40 +0200
Re: [PATCH 4.1 000/102] 4.1.8-stable review Sudip Mukherjee <sudipm.mukherjee@gmail.com> - 2015-09-21 07:50 +0200
Re: [PATCH 4.1 000/102] 4.1.8-stable review Shuah Khan <shuahkh@osg.samsung.com> - 2015-09-21 18:30 +0200
csiph-web