• Roger Tseng's avatar
    mfd: rtsx_usb: Prevent DMA from stack · 3a43477f
    Roger Tseng authored
    Functions rtsx_usb_ep0_read_register() and rtsx_usb_get_card_status()
    both use arbitrary buffer addresses from arguments directly for DMA and
    the buffers could be located in stack. This was caught by DMA-API debug
    check.
    
    Fixes this by using double-buffers via kzalloc in both functions to
    guarantee the validity of DMA buffer.
    
    WARNING: CPU: 1 PID: 25 at lib/dma-debug.c:1166 check_for_stack+0x96/0xe0()
    ehci-pci 0000:00:1a.0: DMA-API: device driver maps memory from stack
    [addr=ffff8801199e3cef]
    Modules linked in: rtsx_usb_ms arc4 memstick intel_rapl iosf_mbi
    rtl8192ce snd_hda_codec_hdmi snd_hda_codec_realtek
    snd_hda_codec_generic snd_hda_intel rtl_pci rtl8192c_common
    snd_hda_controller x86_pkg_temp_thermal snd_hda_codec rtlwifi mac80211
    coretemp kvm_intel kvm iTCO_wdt snd_hwdep snd_seq snd_seq_device
    crct10dif_pclmul iTCO_vendor_support sparse_keymap cfg80211
    crc32_pclmul snd_pcm crc32c_intel ghash_clmulni_intel rfkill i2c_i801
    snd_timer shpchp snd serio_raw mei_me lpc_ich soundcore mei tpm_tis
    tpm wmi nfsd auth_rpcgss nfs_acl lockd grace sunrpc i915
    rtsx_usb_sdmmc mmc_core 8021q uas garp stp i2c_algo_bit llc mrp
    drm_kms_helper usb_storage drm rtsx_usb mfd_core r8169 mii video
    CPU: 1 PID: 25 Comm: kworker/1:2 Not tainted 3.20.0-0.rc0.git7.3.fc22.x86_64 #1
    Hardware name: WB WB-B06211/WB-B0621, BIOS EB062IWB V1.0 12/12/2013
    Workqueue: events rtsx_usb_ms_handle_req [rtsx_usb_ms]
     0000000000000000 000000003d188e66 ffff8801199e3808 ffffffff8187642b
     0000000000000000 ffff8801199e3860 ffff8801199e3848 ffffffff810ab39a
     ffff8801199e3864 ffff8801199e3cef ffff880119b57098 ffff880119b37320
    Call Trace:
     [<ffffffff8187642b>] dump_stack+0x4c/0x65
     [<ffffffff810ab39a>] warn_slowpath_common+0x8a/0xc0
     [<ffffffff810ab425>] warn_slowpath_fmt+0x55/0x70
     [<ffffffff8187efe6>] ? _raw_spin_unlock_irqrestore+0x36/0x70
     [<ffffffff81453156>] check_for_stack+0x96/0xe0
     [<ffffffff81453934>] debug_dma_map_page+0x104/0x150
     [<ffffffff81613b86>] usb_hcd_map_urb_for_dma+0x646/0x790
     [<ffffffff81614165>] usb_hcd_submit_urb+0x1d5/0xa90
     [<ffffffff81106f8f>] ? mark_held_locks+0x7f/0xc0
     [<ffffffff81106f8f>] ? mark_held_locks+0x7f/0xc0
     [<ffffffff81103a15>] ? lockdep_init_map+0x65/0x5d0
     [<ffffffff81615d7e>] usb_submit_urb+0x42e/0x5f0
     [<ffffffff81616787>] usb_start_wait_urb+0x77/0x190
     [<ffffffff8124f035>] ? __kmalloc+0x205/0x2d0
     [<ffffffff8161697c>] usb_control_msg+0xdc/0x130
     [<ffffffffa0031669>] rtsx_usb_ep0_read_register+0x59/0x70 [rtsx_usb]
     [<ffffffffa00310c1>] ? rtsx_usb_get_rsp+0x41/0x50 [rtsx_usb]
     [<ffffffffa071da4e>] rtsx_usb_ms_handle_req+0x7ce/0x9c5 [rtsx_usb_ms]
    Reported-by: default avatarJosh Boyer <jwboyer@fedoraproject.org>
    Signed-off-by: default avatarRoger Tseng <rogerable@realtek.com>
    Signed-off-by: default avatarLee Jones <lee.jones@linaro.org>
    3a43477f
rtsx_usb.c 18.8 KB