Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1252340
| From | Kamal Mostafa <kamal@canonical.com> |
|---|---|
| Newsgroups | linux.kernel |
| Subject | [PATCH 3.13.y-ckt 12/85] usb: dwc3: ep0: Fix mem corruption on OUT transfers of more than 512 bytes |
| Date | 2015-10-21 01:00 +0200 |
| Message-ID | <qlO2T-10k-45@gated-at.bofh.it> (permalink) |
| References | <qlMNr-7E9-5@gated-at.bofh.it> |
| Organization | linux.* mail to news gateway |
3.13.11-ckt28 -stable review patch. If anyone has any objections, please let me know.
------------------
From: Kishon Vijay Abraham I <kishon@ti.com>
commit b2fb5b1a0f50d3ebc12342c8d8dead245e9c9d4e upstream.
DWC3 uses bounce buffer to handle non max packet aligned OUT transfers and
the size of bounce buffer is 512 bytes. However if the host initiates OUT
transfers of size more than 512 bytes (and non max packet aligned), the
driver throws a WARN dump but still programs the TRB to receive more than
512 bytes. This will cause bounce buffer to overflow and corrupt the
adjacent memory locations which can be fatal.
Fix it by programming the TRB to receive a maximum of DWC3_EP0_BOUNCE_SIZE
(512) bytes.
Signed-off-by: Kishon Vijay Abraham I <kishon@ti.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
drivers/usb/dwc3/ep0.c | 12 ++++++++++--
1 file changed, 10 insertions(+), 2 deletions(-)
diff --git a/drivers/usb/dwc3/ep0.c b/drivers/usb/dwc3/ep0.c
index bcefce0..312bc05 100644
--- a/drivers/usb/dwc3/ep0.c
+++ b/drivers/usb/dwc3/ep0.c
@@ -793,6 +793,11 @@ static void dwc3_ep0_complete_data(struct dwc3 *dwc,
unsigned maxp = ep0->endpoint.maxpacket;
transfer_size += (maxp - (transfer_size % maxp));
+
+ /* Maximum of DWC3_EP0_BOUNCE_SIZE can only be received */
+ if (transfer_size > DWC3_EP0_BOUNCE_SIZE)
+ transfer_size = DWC3_EP0_BOUNCE_SIZE;
+
transferred = min_t(u32, ur->length,
transfer_size - length);
memcpy(ur->buf, dwc->ep0_bounce, transferred);
@@ -905,11 +910,14 @@ static void __dwc3_ep0_do_control_data(struct dwc3 *dwc,
return;
}
- WARN_ON(req->request.length > DWC3_EP0_BOUNCE_SIZE);
-
maxpacket = dep->endpoint.maxpacket;
transfer_size = roundup(req->request.length, maxpacket);
+ if (transfer_size > DWC3_EP0_BOUNCE_SIZE) {
+ dev_WARN(dwc->dev, "bounce buf can't handle req len\n");
+ transfer_size = DWC3_EP0_BOUNCE_SIZE;
+ }
+
dwc->ep0_bounced = true;
/*
--
1.9.1
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
[3.13.y-ckt stable] Linux 3.13.11-ckt28 stable review Kamal Mostafa <kamal@canonical.com> - 2015-10-20 23:40 +0200
[PATCH 3.13.y-ckt 73/85] perf hists: Update the column width for the "srcline" sort key Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:30 +0200
[PATCH 3.13.y-ckt 84/85] task_work: remove fifo ordering guarantee Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:30 +0200
[PATCH 3.13.y-ckt 65/85] drm/qxl: validate monitors config modes Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:30 +0200
[PATCH 3.13.y-ckt 85/85] scsi_dh: fix randconfig build error Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:30 +0200
[PATCH 3.13.y-ckt 82/85] mmc: core: fix race condition in mmc_wait_data_done Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:30 +0200
[PATCH 3.13.y-ckt 81/85] IB/uverbs: Fix race between ib_uverbs_open and remove_one Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:30 +0200
[PATCH 3.13.y-ckt 79/85] IB/mlx4: Forbid using sysfs to change RoCE pkeys Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:30 +0200
[PATCH 3.13.y-ckt 80/85] IB/mlx4: Use correct SL on AH query under RoCE Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:30 +0200
[PATCH 3.13.y-ckt 83/85] ipv6: fix exthdrs offload registration in out_rt path Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:30 +0200
[PATCH 3.13.y-ckt 77/85] perf stat: Get correct cpu id for print_aggr Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:30 +0200
[PATCH 3.13.y-ckt 67/85] x86/mm: Initialize pmd_idx in page_table_range_init_count() Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:40 +0200
[PATCH 3.13.y-ckt 55/85] Input: evdev - do not report errors form flush() Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:40 +0200
[PATCH 3.13.y-ckt 48/85] xfs: return errors from partial I/O failures to files Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:40 +0200
[PATCH 3.13.y-ckt 75/85] batman-adv: Make NC capability changes atomic Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:40 +0200
[PATCH 3.13.y-ckt 69/85] jbd2: avoid infinite loop when destroying aborted journal Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:40 +0200
[PATCH 3.13.y-ckt 56/85] crypto: ghash-clmulni: specify context size for ghash async algorithm Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:40 +0200
[PATCH 3.13.y-ckt 50/85] tg3: Fix temperature reporting Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:40 +0200
[PATCH 3.13.y-ckt 60/85] scsi: fix scsi_error_handler vs. scsi_host_dev_release race Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:40 +0200
[PATCH 3.13.y-ckt 49/85] IB/qib: Change lkey table allocation to support more MRs Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:40 +0200
[PATCH 3.13.y-ckt 70/85] clk: versatile: off by one in clk_sp810_timerclken_of_get() Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:40 +0200
[PATCH 3.13.y-ckt 74/85] batman-adv: Make DAT capability changes atomic Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:40 +0200
[PATCH 3.13.y-ckt 41/85] Btrfs: check if previous transaction aborted to avoid fs corruption Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:40 +0200
[PATCH 3.13.y-ckt 71/85] usb: gadget: m66592-udc: forever loop in set_feature() Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:40 +0200
[PATCH 3.13.y-ckt 78/85] IB/mlx4: Fix potential deadlock when sending mad to wire Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:40 +0200
[PATCH 3.13.y-ckt 57/85] fs: create and use seq_show_option for escaping Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:40 +0200
[PATCH 3.13.y-ckt 58/85] ALSA: hda - Enable headphone jack detect on old Fujitsu laptops Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:40 +0200
[PATCH 3.13.y-ckt 53/85] IB/uverbs: reject invalid or unknown opcodes Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:40 +0200
[PATCH 3.13.y-ckt 61/85] parisc: Use double word condition in 64bit CAS operation Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:40 +0200
[PATCH 3.13.y-ckt 76/85] powerpc/mm: Fix pte_pagesize_index() crash on 4K w/64K hash Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:40 +0200
[PATCH 3.13.y-ckt 51/85] drm/i915: Always mark the object as dirty when used by the GPU Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:40 +0200
[PATCH 3.13.y-ckt 54/85] hpfs: update ctime and mtime on directory modification Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:40 +0200
[PATCH 3.13.y-ckt 46/85] drivercore: Fix unregistration path of platform devices Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:40 +0200
[PATCH 3.13.y-ckt 68/85] powerpc/rtas: Introduce rtas_get_sensor_fast() for IRQ handlers Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:40 +0200
[PATCH 3.13.y-ckt 47/85] Input: synaptics - fix handling of disabling gesture mode Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:40 +0200
Re: [PATCH 3.13.y-ckt 47/85] Input: synaptics - fix handling of disabling gesture mode Dmitry Torokhov <dmitry.torokhov@gmail.com> - 2015-10-21 00:50 +0200
Re: [PATCH 3.13.y-ckt 47/85] Input: synaptics - fix handling of disabling gesture mode Kamal Mostafa <kamal@canonical.com> - 2015-10-21 22:30 +0200
[PATCH 3.13.y-ckt 43/85] rtlwifi: rtl8192cu: Add new device ID Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:40 +0200
[PATCH 3.13.y-ckt 21/85] iio: event: Remove negative error code from iio_event_poll Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:40 +0200
[PATCH 3.13.y-ckt 72/85] windfarm: decrement client count when unregistering Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:40 +0200
[PATCH 3.13.y-ckt 22/85] NFSv4: don't set SETATTR for O_RDONLY|O_EXCL Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:40 +0200
[PATCH 3.13.y-ckt 52/85] Add radeon suspend/resume quirk for HP Compaq dc5750. Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:40 +0200
[PATCH 3.13.y-ckt 59/85] ALSA: hda - Use ALC880_FIXUP_FUJITSU for FSC Amilo M1437 Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:40 +0200
[PATCH 3.13.y-ckt 35/85] USB: ftdi_sio: Added custom PID for CustomWare products Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:50 +0200
[PATCH 3.13.y-ckt 30/85] xtensa: fix kernel register spilling Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:50 +0200
[PATCH 3.13.y-ckt 26/85] drivers: usb: fsl: Workaround for USB erratum-A005275 Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:50 +0200
[PATCH 3.13.y-ckt 36/85] HID: usbhid: Fix the check for HID_RESET_PENDING in hid_io_error Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:50 +0200
[PATCH 3.13.y-ckt 17/85] iio: adis16400: Fix adis16448 gyroscope scale Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:50 +0200
[PATCH 3.13.y-ckt 38/85] libxfs: readahead of dir3 data blocks should use the read verifier Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:50 +0200
[PATCH 3.13.y-ckt 18/85] iio: Add inverse unit conversion macros Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:50 +0200
[PATCH 3.13.y-ckt 37/85] eCryptfs: Invalidate dcache entries when lower i_nlink is zero Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:50 +0200
[PATCH 3.13.y-ckt 31/85] NFS: nfs_set_pgio_error sometimes misses errors Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:50 +0200
[PATCH 3.13.y-ckt 44/85] rtlwifi: rtl8192cu: Add new device ID Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:50 +0200
[PATCH 3.13.y-ckt 45/85] of/address: Don't loop forever in of_find_matching_node_by_address(). Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:50 +0200
[PATCH 3.13.y-ckt 28/85] staging: comedi: adl_pci7x3x: fix digital output on PCI-7230 Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:50 +0200
[PATCH 3.13.y-ckt 39/85] xfs: Fix xfs_attr_leafblock definition Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:50 +0200
[PATCH 3.13.y-ckt 27/85] serial: 8250: don't bind to SMSC IrCC IR port Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:50 +0200
[PATCH 3.13.y-ckt 34/85] USB: symbolserial: Use usb_get_serial_port_data Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:50 +0200
[PATCH 3.13.y-ckt 32/85] NFS: Fix a NULL pointer dereference of migration recovery ops for v4.2 client Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:50 +0200
[PATCH 3.13.y-ckt 29/85] blk-mq: fix buffer overflow when reading sysfs file of 'pending' Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:50 +0200
[PATCH 3.13.y-ckt 42/85] DRM - radeon: Don't link train DisplayPort on HPD until we get the dpcd Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:50 +0200
[PATCH 3.13.y-ckt 33/85] usb: host: ehci-sys: delete useless bus_to_hcd conversion Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:50 +0200
[PATCH 3.13.y-ckt 40/85] arm64: kconfig: Move LIST_POISON to a safe value Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:50 +0200
[PATCH 3.13.y-ckt 02/85] dcache: Handle escaped paths in prepend_path Kamal Mostafa <kamal@canonical.com> - 2015-10-21 00:50 +0200
[PATCH 3.13.y-ckt 07/85] xtensa: fix threadptr reload on return to userspace Kamal Mostafa <kamal@canonical.com> - 2015-10-21 01:00 +0200
[PATCH 3.13.y-ckt 03/85] vfs: Test for and handle paths that are unreachable from their mnt_root Kamal Mostafa <kamal@canonical.com> - 2015-10-21 01:00 +0200
[PATCH 3.13.y-ckt 05/85] [media] v4l: omap3isp: Fix sub-device power management code Kamal Mostafa <kamal@canonical.com> - 2015-10-21 01:00 +0200
[PATCH 3.13.y-ckt 16/85] devres: fix devres_get() Kamal Mostafa <kamal@canonical.com> - 2015-10-21 01:00 +0200
[PATCH 3.13.y-ckt 08/85] ARM: OMAP2+: DRA7: clockdomain: change l4per2_7xx_clkdm to SW_WKUP Kamal Mostafa <kamal@canonical.com> - 2015-10-21 01:00 +0200
[PATCH 3.13.y-ckt 04/85] sctp: fix race on protocol/netns initialization Kamal Mostafa <kamal@canonical.com> - 2015-10-21 01:00 +0200
[PATCH 3.13.y-ckt 12/85] usb: dwc3: ep0: Fix mem corruption on OUT transfers of more than 512 bytes Kamal Mostafa <kamal@canonical.com> - 2015-10-21 01:00 +0200
[PATCH 3.13.y-ckt 14/85] KVM: MMU: fix validation of mmio page fault Kamal Mostafa <kamal@canonical.com> - 2015-10-21 01:00 +0200
[PATCH 3.13.y-ckt 11/85] PCI: Add VPD function 0 quirk for Intel Ethernet devices Kamal Mostafa <kamal@canonical.com> - 2015-10-21 01:00 +0200
[PATCH 3.13.y-ckt 10/85] PCI: Add dev_flags bit to access VPD through function 0 Kamal Mostafa <kamal@canonical.com> - 2015-10-21 01:00 +0200
[PATCH 3.13.y-ckt 15/85] auxdisplay: ks0108: fix refcount Kamal Mostafa <kamal@canonical.com> - 2015-10-21 01:00 +0200
[PATCH 3.13.y-ckt 09/85] mac80211: enable assoc check for mesh interfaces Kamal Mostafa <kamal@canonical.com> - 2015-10-21 01:00 +0200
[PATCH 3.13.y-ckt 13/85] serial: 8250_pci: Add support for Pericom PI7C9X795[1248] Kamal Mostafa <kamal@canonical.com> - 2015-10-21 01:00 +0200
csiph-web