patch "xhci: Fix crash if scatter gather is used with Immediate Data" added to usb-linus
This is a note to let you know that I've just added the patch titled
xhci: Fix crash if scatter gather is used with Immediate Data
to my usb git tree which can be found at git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git in the usb-linus branch.
The patch will show up in the next release of the linux-next tree (usually sometime within the next 24 hours during the week.)
The patch will hopefully also be merged in Linus's tree for the next -rc kernel release.
If you have any questions about this process, please let me know.
From d39b5bad8658d6d94cb2d98a44a7e159db4f5030 Mon Sep 17 00:00:00 2001
From: Mathias Nyman mathias.nyman@linux.intel.com Date: Thu, 25 Jul 2019 11:54:21 +0300 Subject: xhci: Fix crash if scatter gather is used with Immediate Data Transfer (IDT).
A second regression was found in the immediate data transfer (IDT) support which was added to 5.2 kernel
IDT is used to transfer small amounts of data (up to 8 bytes) in the field normally used for data dma address, thus avoiding dma mapping.
If the data was not already dma mapped, then IDT support assumed data was in urb->transfer_buffer, and did not take into accound that even small amounts of data (8 bytes) can be in a scatterlist instead.
This caused a NULL pointer dereference when sg_dma_len() was used with non-dma mapped data.
Solve this by not using IDT if scatter gather buffer list is used.
Fixes: 33e39350ebd2 ("usb: xhci: add Immediate Data Transfer support") Cc: stable@vger.kernel.org # v5.2 Reported-by: Maik Stohn maik.stohn@seal-one.com Tested-by: Maik Stohn maik.stohn@seal-one.com CC: Nicolas Saenz Julienne nsaenzjulienne@suse.de Signed-off-by: Mathias Nyman mathias.nyman@linux.intel.com Link: https://lore.kernel.org/r/1564044861-1445-1-git-send-email-mathias.nyman@lin... Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- drivers/usb/host/xhci.h | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h index 7a264962a1a9..f5c41448d067 100644 --- a/drivers/usb/host/xhci.h +++ b/drivers/usb/host/xhci.h @@ -2175,7 +2175,8 @@ static inline bool xhci_urb_suitable_for_idt(struct urb *urb) if (!usb_endpoint_xfer_isoc(&urb->ep->desc) && usb_urb_dir_out(urb) && usb_endpoint_maxp(&urb->ep->desc) >= TRB_IDT_MAX_SIZE && urb->transfer_buffer_length <= TRB_IDT_MAX_SIZE && - !(urb->transfer_flags & URB_NO_TRANSFER_DMA_MAP)) + !(urb->transfer_flags & URB_NO_TRANSFER_DMA_MAP) && + !urb->num_sgs) return true;
return false;
Hello Greg,
Sorry to trouble you again.
I was waiting and observing how the FIX is applied and it looks like it will not be applied to 5.2.x (5.2.3 and 5.2.4 came out without this patch). Personally I think it is a big mistake not to merge the fix but this is your decision.
I have to tell my users now to AVOID KERNEL 5.2 at all since it is buggy and most likely will never be fixed.
But since it is also not part of any 5.3 (right now) I'm a bit afraid I also need to put a warning to avoid 5.3 as well.
Would be nice to get an official statement like: "Linux kernel will not merge the USB fix to 5.2, maybe 5.3 will have it, but better wait for 5.4", so I can quote this to my users.
Best Regards,
Maik Stohn
Am 25.07.2019 um 11:27 schrieb gregkh@linuxfoundation.org:
This is a note to let you know that I've just added the patch titled
xhci: Fix crash if scatter gather is used with Immediate Data
to my usb git tree which can be found at git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git in the usb-linus branch.
The patch will show up in the next release of the linux-next tree (usually sometime within the next 24 hours during the week.)
The patch will hopefully also be merged in Linus's tree for the next -rc kernel release.
If you have any questions about this process, please let me know.
From d39b5bad8658d6d94cb2d98a44a7e159db4f5030 Mon Sep 17 00:00:00 2001 From: Mathias Nyman mathias.nyman@linux.intel.com Date: Thu, 25 Jul 2019 11:54:21 +0300 Subject: xhci: Fix crash if scatter gather is used with Immediate Data Transfer (IDT).
A second regression was found in the immediate data transfer (IDT) support which was added to 5.2 kernel
IDT is used to transfer small amounts of data (up to 8 bytes) in the field normally used for data dma address, thus avoiding dma mapping.
If the data was not already dma mapped, then IDT support assumed data was in urb->transfer_buffer, and did not take into accound that even small amounts of data (8 bytes) can be in a scatterlist instead.
This caused a NULL pointer dereference when sg_dma_len() was used with non-dma mapped data.
Solve this by not using IDT if scatter gather buffer list is used.
Fixes: 33e39350ebd2 ("usb: xhci: add Immediate Data Transfer support") Cc: stable@vger.kernel.org # v5.2 Reported-by: Maik Stohn maik.stohn@seal-one.com Tested-by: Maik Stohn maik.stohn@seal-one.com CC: Nicolas Saenz Julienne nsaenzjulienne@suse.de Signed-off-by: Mathias Nyman mathias.nyman@linux.intel.com Link: https://lore.kernel.org/r/1564044861-1445-1-git-send-email-mathias.nyman@lin... Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org
drivers/usb/host/xhci.h | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h index 7a264962a1a9..f5c41448d067 100644 --- a/drivers/usb/host/xhci.h +++ b/drivers/usb/host/xhci.h @@ -2175,7 +2175,8 @@ static inline bool xhci_urb_suitable_for_idt(struct urb *urb) if (!usb_endpoint_xfer_isoc(&urb->ep->desc) && usb_urb_dir_out(urb) && usb_endpoint_maxp(&urb->ep->desc) >= TRB_IDT_MAX_SIZE && urb->transfer_buffer_length <= TRB_IDT_MAX_SIZE &&
!(urb->transfer_flags & URB_NO_TRANSFER_DMA_MAP))
!(urb->transfer_flags & URB_NO_TRANSFER_DMA_MAP) &&!urb->num_sgs)return true;
return false;
-- 2.22.0
On Sun, Jul 28, 2019 at 01:25:32PM +0200, Maik Stohn wrote:
Hello Greg,
Sorry to trouble you again.
I was waiting and observing how the FIX is applied and it looks like it will not be applied to 5.2.x (5.2.3 and 5.2.4 came out without this patch). Personally I think it is a big mistake not to merge the fix but this is your decision.
I have to tell my users now to AVOID KERNEL 5.2 at all since it is buggy and most likely will never be fixed.
But since it is also not part of any 5.3 (right now) I'm a bit afraid I also need to put a warning to avoid 5.3 as well.
Would be nice to get an official statement like: "Linux kernel will not merge the USB fix to 5.2, maybe 5.3 will have it, but better wait for 5.4", so I can quote this to my users.
How about an official statement like "wait a week please" :)
Or, "if you have problems, please apply this patch."
We _just_ found the fix, it _just_ went into my tree a few days ago. A patch can not be in a stable kernel until it shows up in Linus's kernel, in a release (like a -rc).
So, ideally this patch gets into 5.3-rc2. Then I can add it to the queue of patches to go into the 5.2.y release, which should happen sometime next week or the week after at worst case.
Please read Documentation/process/ for how all of this works if you are curious, we have tests to pass, releases to make it through, and reviews to happen here. Give us a chance please, there is no major rush. And if there is a rush, you have the fix to apply to your kernel to solve the problem! You are not dependant on any of us here anymore, anyone can patch their machines if they run into this issue and can not wait a week or so.
Also, odds are that most people are even running the 5.2.y kernel yet is pretty low... :)
So, again, patience. Your fix is just one of hundreds winding its way through the ether to get out to users. You are not alone, and at the same time, not special. It will happen, just relax.
greg k-h
linux-stable-mirror@lists.linaro.org
-
Greg KH -
gregkh＠linuxfoundation.org
-
Maik Stohn