Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1228494

[PATCH 3.10 09/20] usb: dwc3: ep0: Fix mem corruption on OUT transfers of more than 512 bytes

Show all headers | View raw

3.10-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Kishon Vijay Abraham I <kishon@ti.com>

commit b2fb5b1a0f50d3ebc12342c8d8dead245e9c9d4e upstream.

DWC3 uses bounce buffer to handle non max packet aligned OUT transfers and
the size of bounce buffer is 512 bytes. However if the host initiates OUT
transfers of size more than 512 bytes (and non max packet aligned), the
driver throws a WARN dump but still programs the TRB to receive more than
512 bytes. This will cause bounce buffer to overflow and corrupt the
adjacent memory locations which can be fatal.

Fix it by programming the TRB to receive a maximum of DWC3_EP0_BOUNCE_SIZE
(512) bytes.

Signed-off-by: Kishon Vijay Abraham I <kishon@ti.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/usb/dwc3/ep0.c |   12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

--- a/drivers/usb/dwc3/ep0.c
+++ b/drivers/usb/dwc3/ep0.c
@@ -804,6 +804,11 @@ static void dwc3_ep0_complete_data(struc
 		unsigned maxp = ep0->endpoint.maxpacket;
 
 		transfer_size += (maxp - (transfer_size % maxp));
+
+		/* Maximum of DWC3_EP0_BOUNCE_SIZE can only be received */
+		if (transfer_size > DWC3_EP0_BOUNCE_SIZE)
+			transfer_size = DWC3_EP0_BOUNCE_SIZE;
+
 		transferred = min_t(u32, ur->length,
 				transfer_size - length);
 		memcpy(ur->buf, dwc->ep0_bounce, transferred);
@@ -916,11 +921,14 @@ static void __dwc3_ep0_do_control_data(s
 			return;
 		}
 
-		WARN_ON(req->request.length > DWC3_EP0_BOUNCE_SIZE);
-
 		maxpacket = dep->endpoint.maxpacket;
 		transfer_size = roundup(req->request.length, maxpacket);
 
+		if (transfer_size > DWC3_EP0_BOUNCE_SIZE) {
+			dev_WARN(dwc->dev, "bounce buf can't handle req len\n");
+			transfer_size = DWC3_EP0_BOUNCE_SIZE;
+		}
+
 		dwc->ep0_bounced = true;
 
 		/*


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH 3.10 00/20] 3.10.89-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-19 19:30 +0200
  [PATCH 3.10 17/20] auxdisplay: ks0108: fix refcount Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-19 19:30 +0200
  [PATCH 3.10 09/20] usb: dwc3: ep0: Fix mem corruption on OUT transfers of more than 512 bytes Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-19 19:30 +0200
  [PATCH 3.10 19/20] drivercore: Fix unregistration path of platform devices Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-19 20:40 +0200
  [PATCH 3.10 16/20] devres: fix devres_get() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-19 20:40 +0200
  [PATCH 3.10 12/20] crypto: ghash-clmulni: specify context size for ghash async algorithm Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-19 20:40 +0200
  [PATCH 3.10 18/20] of/address: Dont loop forever in of_find_matching_node_by_address(). Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-19 20:40 +0200
  [PATCH 3.10 20/20] hpfs: update ctime and mtime on directory modification Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-19 20:40 +0200
  [PATCH 3.10 08/20] USB: ftdi_sio: Added custom PID for CustomWare products Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-19 20:40 +0200
  [PATCH 3.10 15/20] xtensa: fix kernel register spilling Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-19 20:50 +0200
  [PATCH 3.10 03/20] iio: Add inverse unit conversion macros Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-19 20:50 +0200
  [PATCH 3.10 02/20] iio: bmg160: IIO_BUFFER and IIO_TRIGGERED_BUFFER are required Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-19 20:50 +0200
  [PATCH 3.10 05/20] clk: versatile: off by one in clk_sp810_timerclken_of_get() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-19 20:50 +0200
  [PATCH 3.10 13/20] HID: usbhid: Fix the check for HID_RESET_PENDING in hid_io_error Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-19 20:50 +0200
  [PATCH 3.10 14/20] xtensa: fix threadptr reload on return to userspace Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-19 20:50 +0200
  [PATCH 3.10 06/20] PCI: Fix TI816X class code quirk Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-19 20:50 +0200
  [PATCH 3.10 11/20] serial: 8250: dont bind to SMSC IrCC IR port Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-19 20:50 +0200
  [PATCH 3.10 07/20] USB: symbolserial: Use usb_get_serial_port_data Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-19 20:50 +0200
  [PATCH 3.10 01/20] DRM - radeon: Dont link train DisplayPort on HPD until we get the dpcd Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-19 20:50 +0200
  [PATCH 3.10 04/20] iio: adis16480: Fix scale factors Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-19 20:50 +0200
  [PATCH 3.10 10/20] usb: host: ehci-sys: delete useless bus_to_hcd conversion Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-19 20:50 +0200
  Re: [PATCH 3.10 00/20] 3.10.89-stable review Guenter Roeck <linux@roeck-us.net> - 2015-09-20 02:20 +0200
  Re: [PATCH 3.10 00/20] 3.10.89-stable review Sudip Mukherjee <sudipm.mukherjee@gmail.com> - 2015-09-20 11:00 +0200
    Re: [PATCH 3.10 00/20] 3.10.89-stable review Guenter Roeck <linux@roeck-us.net> - 2015-09-20 18:10 +0200
      Re: [PATCH 3.10 00/20] 3.10.89-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-09-21 06:40 +0200
  Re: [PATCH 3.10 00/20] 3.10.89-stable review Sudip Mukherjee <sudipm.mukherjee@gmail.com> - 2015-09-21 10:40 +0200

csiph-web