From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 506E1E7D0C5 for ; Mon, 25 Sep 2023 23:53:47 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229813AbjIYXxv (ORCPT ); Mon, 25 Sep 2023 19:53:51 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:41974 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229592AbjIYXxu (ORCPT ); Mon, 25 Sep 2023 19:53:50 -0400 Received: from rere.qmqm.pl (rere.qmqm.pl [91.227.64.183]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id CDEF1101; Mon, 25 Sep 2023 16:53:42 -0700 (PDT) Received: from remote.user (localhost [127.0.0.1]) by rere.qmqm.pl (Postfix) with ESMTPSA id 4RvfpX3bCrz9c; Tue, 26 Sep 2023 01:53:40 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=rere.qmqm.pl; s=1; t=1695686021; bh=v/enpArCGKFex8326oiW+kSnRwwaqY0D+TB5vC+M6B0=; h=Date:From:To:Cc:Subject:References:In-Reply-To:From; b=j4rPE1sgQXDghzDumyjisrBhl9qDBxZp4i4DeZuQgsHZy+iSgeGqvaqgG1DyvQ1HB CmEHhyXP5UWngRHIfBKlKCmZUhshcWCjyOEWT5B2Wqo57YnuFzfH/aEp+k6T2oeeID kI+In6QMS7RFgzC9qwvYChOhPaqok8n2welcHg0NxX4Px0MVHKsEy3i3igRvfYNm39 2sReddfamdcKBwrsrgrICICE6r0I+EdU9ftBcbG1XVwN24mEca/M83H5rEy4ro8zOD LppTICsNRkbl0CgjtoIV1zjO/2S/09QapLBlR71f6v0IdL5tD/xcuIEVmkVAt6G5ru HM7/40ST/sjKg== X-Virus-Status: Clean X-Virus-Scanned: clamav-milter 0.103.10 at mail Date: Tue, 26 Sep 2023 01:53:39 +0200 From: =?iso-8859-2?Q?Micha=B3_Miros=B3aw?= To: Peter Chen Cc: Greg Kroah-Hartman , Thierry Reding , Dmitry Osipenko , Peter Geis , Jonathan Hunter , linux-usb@vger.kernel.org, linux-kernel@vger.kernel.org, linux-arm-kernel@lists.infradead.org, linux-tegra@vger.kernel.org Subject: Re: [PATCH 1/3] usb: chipidea: Fix DMA overwrite for Tegra Message-ID: References: <20230925114522.GA2070044@nchen-desktop> MIME-Version: 1.0 Content-Type: text/plain; charset=iso-8859-2 Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: <20230925114522.GA2070044@nchen-desktop> Precedence: bulk List-ID: X-Mailing-List: linux-tegra@vger.kernel.org On Mon, Sep 25, 2023 at 07:45:22PM +0800, Peter Chen wrote: > On 23-09-23 21:41:55, Michał Mirosław wrote: > > Tegra USB controllers seem to issue DMA in doubleword-sized chunks and thus > > may write past the buffer provided. This is detected by SLUB: > > > > ============================================================================= > > BUG kmalloc-64 (Tainted: G B ): kmalloc Redzone overwritten > > ----------------------------------------------------------------------------- > > > > 0x8555cd02-0x8555cd03 @offset=3330. First byte 0x0 instead of 0xcc > > Allocated in usb_get_status+0x2b/0xac age=1 cpu=3 pid=41 > > __kmem_cache_alloc_node+0x12f/0x1e4 > > __kmalloc+0x33/0x8c > > usb_get_status+0x2b/0xac > > hub_probe+0x5e9/0xcec > > usb_probe_interface+0xbf/0x21c > > really_probe+0xa5/0x2c4 > > __driver_probe_device+0x75/0x174 > > driver_probe_device+0x31/0x94 > > __device_attach_driver+0x65/0xc0 > > bus_for_each_drv+0x4b/0x74 > > __device_attach+0x69/0x120 > > bus_probe_device+0x65/0x6c > > device_add+0x48b/0x5f8 > > usb_set_configuration+0x37b/0x6b4 > > usb_generic_driver_probe+0x37/0x68 > > usb_probe_device+0x35/0xb4 > > Slab 0xbf622b80 objects=21 used=18 fp=0x8555cdc0 flags=0x800(slab|zone=0) > > Object 0x8555cd00 @offset=3328 fp=0x00000000 > > > > Redzone 8555ccc0: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc ................ > > Redzone 8555ccd0: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc ................ > > Redzone 8555cce0: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc ................ > > Redzone 8555ccf0: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc ................ > > Object 8555cd00: 01 00 00 00 cc cc cc cc cc cc cc cc cc cc cc cc ................ > > Object 8555cd10: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc ................ > > Object 8555cd20: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc ................ > > Object 8555cd30: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc ................ > > Redzone 8555cd40: cc cc cc cc .... > > Padding 8555cd74: 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a ZZZZZZZZZZZZ > > CPU: 3 PID: 41 Comm: kworker/3:1 Tainted: G B 6.6.0-rc1mq-00118-g59786f827ea1 #1115 > > Hardware name: NVIDIA Tegra SoC (Flattened Device Tree) > > Workqueue: usb_hub_wq hub_event > > [<8010ca28>] (unwind_backtrace) from [<801090a5>] (show_stack+0x11/0x14) > > [<801090a5>] (show_stack) from [<805da2fb>] (dump_stack_lvl+0x4d/0x7c) > > [<805da2fb>] (dump_stack_lvl) from [<8026464f>] (check_bytes_and_report+0xb3/0xe4) > > [<8026464f>] (check_bytes_and_report) from [<802648e1>] (check_object+0x261/0x290) > > [<802648e1>] (check_object) from [<802671b1>] (free_to_partial_list+0x105/0x3f8) > > [<802671b1>] (free_to_partial_list) from [<80268613>] (__kmem_cache_free+0x103/0x128) > > [<80268613>] (__kmem_cache_free) from [<80425a67>] (usb_get_status+0x73/0xac) > > [<80425a67>] (usb_get_status) from [<80421b31>] (hub_probe+0x5e9/0xcec) > > [<80421b31>] (hub_probe) from [<80428bbb>] (usb_probe_interface+0xbf/0x21c) > > [<80428bbb>] (usb_probe_interface) from [<803ee13d>] (really_probe+0xa5/0x2c4) > > [<803ee13d>] (really_probe) from [<803ee3d1>] (__driver_probe_device+0x75/0x174) > > [<803ee3d1>] (__driver_probe_device) from [<803ee501>] (driver_probe_device+0x31/0x94) > > usb 1-1: device descriptor read/8, error -71 > > > > Fixes: fc53d5279094 ("usb: chipidea: tegra: Support host mode") > > Signed-off-by: Michał Mirosław > > --- > > drivers/usb/chipidea/host.c | 7 ++++--- > > 1 file changed, 4 insertions(+), 3 deletions(-) > > > > diff --git a/drivers/usb/chipidea/host.c b/drivers/usb/chipidea/host.c > > index 08af26b762a2..abddd39d1ff1 100644 > > --- a/drivers/usb/chipidea/host.c > > +++ b/drivers/usb/chipidea/host.c > > @@ -411,12 +411,13 @@ static int ci_hdrc_alloc_dma_aligned_buffer(struct urb *urb, gfp_t mem_flags) > > const unsigned int ci_hdrc_usb_dma_align = 32; > > size_t kmalloc_size; > > > > - if (urb->num_sgs || urb->sg || urb->transfer_buffer_length == 0 || > > - !((uintptr_t)urb->transfer_buffer & (ci_hdrc_usb_dma_align - 1))) > > + if (urb->num_sgs || urb->sg || urb->transfer_buffer_length == 0) > > + return 0; > > + if (!((uintptr_t)urb->transfer_buffer & (ci_hdrc_usb_dma_align - 1)) && !(urb->transfer_buffer_length & 3)) > > return 0; > > > > /* Allocate a buffer with enough padding for alignment */ > > - kmalloc_size = urb->transfer_buffer_length + > > + kmalloc_size = ALIGN(urb->transfer_buffer_length, 4) + > > sizeof(struct ci_hdrc_dma_aligned_buffer) + > > ci_hdrc_usb_dma_align - 1; > > > > Would you please explain why you make these changes? Can you point out what's unclear in the commit message? This is to fix a buffer overflow by DMA from the USB controller as it seems to write data 32-bit word at a time. What the patch does is extend the workaround code to account for the extra room needed at the tail of the buffer. Best Regards Michał Mirosław From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 59E38E6FE31 for ; Mon, 25 Sep 2023 23:54:18 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:List-Subscribe:List-Help:List-Post: List-Archive:List-Unsubscribe:List-Id:In-Reply-To:MIME-Version:References: Message-ID:Subject:Cc:To:From:Date:Reply-To:Content-ID:Content-Description: Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: List-Owner; bh=adArw7J+BBWp/CA4SJ1zqYiR1Td3qdrii/LppUGKtbc=; b=vorvREb0ih4C96 tjM5CIQYSiF0qhoEFQjgR1157lGm6iNGHT6nJxhnCT1HNescSRFkaTkbiC4tvV6P9UuWY+joogc3a 5iEcHTC1xn2GkJ3OlonxuYY5r4cxjIfpKbLz5L+8kO2W79w5MWscSvEy0i1Wh5/8hCyb9SZqGnF1H WzId8Mkba7h1HQ1hdymqGIjwmX5ohUGz36g7Mi24m5dvcXG1ZbjK6uTdhrTrXMW4/81CF7enEKbd9 jQ2iOZcOQebniSk32iEnBtiEJYzy4fm+Xee0l27nw4TNUhOj9gaX80O7XxhGYSzaAS/PmF0GaWuh8 iuqBEyoMg1Ep1Ml6xJFA==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.96 #2 (Red Hat Linux)) id 1qkvOg-00FFZu-2A; Mon, 25 Sep 2023 23:53:50 +0000 Received: from rere.qmqm.pl ([91.227.64.183]) by bombadil.infradead.org with esmtps (Exim 4.96 #2 (Red Hat Linux)) id 1qkvOd-00FFYq-10 for linux-arm-kernel@lists.infradead.org; Mon, 25 Sep 2023 23:53:49 +0000 Received: from remote.user (localhost [127.0.0.1]) by rere.qmqm.pl (Postfix) with ESMTPSA id 4RvfpX3bCrz9c; Tue, 26 Sep 2023 01:53:40 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=rere.qmqm.pl; s=1; t=1695686021; bh=v/enpArCGKFex8326oiW+kSnRwwaqY0D+TB5vC+M6B0=; h=Date:From:To:Cc:Subject:References:In-Reply-To:From; b=j4rPE1sgQXDghzDumyjisrBhl9qDBxZp4i4DeZuQgsHZy+iSgeGqvaqgG1DyvQ1HB CmEHhyXP5UWngRHIfBKlKCmZUhshcWCjyOEWT5B2Wqo57YnuFzfH/aEp+k6T2oeeID kI+In6QMS7RFgzC9qwvYChOhPaqok8n2welcHg0NxX4Px0MVHKsEy3i3igRvfYNm39 2sReddfamdcKBwrsrgrICICE6r0I+EdU9ftBcbG1XVwN24mEca/M83H5rEy4ro8zOD LppTICsNRkbl0CgjtoIV1zjO/2S/09QapLBlR71f6v0IdL5tD/xcuIEVmkVAt6G5ru HM7/40ST/sjKg== X-Virus-Status: Clean X-Virus-Scanned: clamav-milter 0.103.10 at mail Date: Tue, 26 Sep 2023 01:53:39 +0200 From: =?iso-8859-2?Q?Micha=B3_Miros=B3aw?= To: Peter Chen Cc: Greg Kroah-Hartman , Thierry Reding , Dmitry Osipenko , Peter Geis , Jonathan Hunter , linux-usb@vger.kernel.org, linux-kernel@vger.kernel.org, linux-arm-kernel@lists.infradead.org, linux-tegra@vger.kernel.org Subject: Re: [PATCH 1/3] usb: chipidea: Fix DMA overwrite for Tegra Message-ID: References: <20230925114522.GA2070044@nchen-desktop> MIME-Version: 1.0 Content-Disposition: inline In-Reply-To: <20230925114522.GA2070044@nchen-desktop> X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20230925_165347_989465_2F95C766 X-CRM114-Status: GOOD ( 23.22 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="iso-8859-2" Content-Transfer-Encoding: quoted-printable Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org On Mon, Sep 25, 2023 at 07:45:22PM +0800, Peter Chen wrote: > On 23-09-23 21:41:55, Micha=B3 Miros=B3aw wrote: > > Tegra USB controllers seem to issue DMA in doubleword-sized chunks and = thus > > may write past the buffer provided. This is detected by SLUB: > > = > > =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D > > BUG kmalloc-64 (Tainted: G B ): kmalloc Redzone overwrit= ten > > -----------------------------------------------------------------------= ------ > > = > > 0x8555cd02-0x8555cd03 @offset=3D3330. First byte 0x0 instead of 0xcc > > Allocated in usb_get_status+0x2b/0xac age=3D1 cpu=3D3 pid=3D41 > > __kmem_cache_alloc_node+0x12f/0x1e4 > > __kmalloc+0x33/0x8c > > usb_get_status+0x2b/0xac > > hub_probe+0x5e9/0xcec > > usb_probe_interface+0xbf/0x21c > > really_probe+0xa5/0x2c4 > > __driver_probe_device+0x75/0x174 > > driver_probe_device+0x31/0x94 > > __device_attach_driver+0x65/0xc0 > > bus_for_each_drv+0x4b/0x74 > > __device_attach+0x69/0x120 > > bus_probe_device+0x65/0x6c > > device_add+0x48b/0x5f8 > > usb_set_configuration+0x37b/0x6b4 > > usb_generic_driver_probe+0x37/0x68 > > usb_probe_device+0x35/0xb4 > > Slab 0xbf622b80 objects=3D21 used=3D18 fp=3D0x8555cdc0 flags=3D0x800(sl= ab|zone=3D0) > > Object 0x8555cd00 @offset=3D3328 fp=3D0x00000000 > > = > > Redzone 8555ccc0: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc ...= ............. > > Redzone 8555ccd0: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc ...= ............. > > Redzone 8555cce0: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc ...= ............. > > Redzone 8555ccf0: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc ...= ............. > > Object 8555cd00: 01 00 00 00 cc cc cc cc cc cc cc cc cc cc cc cc ...= ............. > > Object 8555cd10: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc ...= ............. > > Object 8555cd20: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc ...= ............. > > Object 8555cd30: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc ...= ............. > > Redzone 8555cd40: cc cc cc cc .... > > Padding 8555cd74: 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a ZZZ= ZZZZZZZZZ > > CPU: 3 PID: 41 Comm: kworker/3:1 Tainted: G B 6.6.0-rc1= mq-00118-g59786f827ea1 #1115 > > Hardware name: NVIDIA Tegra SoC (Flattened Device Tree) > > Workqueue: usb_hub_wq hub_event > > [<8010ca28>] (unwind_backtrace) from [<801090a5>] (show_stack+0x11/0x14) > > [<801090a5>] (show_stack) from [<805da2fb>] (dump_stack_lvl+0x4d/0x7c) > > [<805da2fb>] (dump_stack_lvl) from [<8026464f>] (check_bytes_and_report= +0xb3/0xe4) > > [<8026464f>] (check_bytes_and_report) from [<802648e1>] (check_object+0= x261/0x290) > > [<802648e1>] (check_object) from [<802671b1>] (free_to_partial_list+0x1= 05/0x3f8) > > [<802671b1>] (free_to_partial_list) from [<80268613>] (__kmem_cache_fre= e+0x103/0x128) > > [<80268613>] (__kmem_cache_free) from [<80425a67>] (usb_get_status+0x73= /0xac) > > [<80425a67>] (usb_get_status) from [<80421b31>] (hub_probe+0x5e9/0xcec) > > [<80421b31>] (hub_probe) from [<80428bbb>] (usb_probe_interface+0xbf/0x= 21c) > > [<80428bbb>] (usb_probe_interface) from [<803ee13d>] (really_probe+0xa5= /0x2c4) > > [<803ee13d>] (really_probe) from [<803ee3d1>] (__driver_probe_device+0x= 75/0x174) > > [<803ee3d1>] (__driver_probe_device) from [<803ee501>] (driver_probe_de= vice+0x31/0x94) > > usb 1-1: device descriptor read/8, error -71 > > = > > Fixes: fc53d5279094 ("usb: chipidea: tegra: Support host mode") > > Signed-off-by: Micha=B3 Miros=B3aw > > --- > > drivers/usb/chipidea/host.c | 7 ++++--- > > 1 file changed, 4 insertions(+), 3 deletions(-) > > = > > diff --git a/drivers/usb/chipidea/host.c b/drivers/usb/chipidea/host.c > > index 08af26b762a2..abddd39d1ff1 100644 > > --- a/drivers/usb/chipidea/host.c > > +++ b/drivers/usb/chipidea/host.c > > @@ -411,12 +411,13 @@ static int ci_hdrc_alloc_dma_aligned_buffer(struc= t urb *urb, gfp_t mem_flags) > > const unsigned int ci_hdrc_usb_dma_align =3D 32; > > size_t kmalloc_size; > > = > > - if (urb->num_sgs || urb->sg || urb->transfer_buffer_length =3D=3D 0 || > > - !((uintptr_t)urb->transfer_buffer & (ci_hdrc_usb_dma_align - 1))) > > + if (urb->num_sgs || urb->sg || urb->transfer_buffer_length =3D=3D 0) > > + return 0; > > + if (!((uintptr_t)urb->transfer_buffer & (ci_hdrc_usb_dma_align - 1)) = && !(urb->transfer_buffer_length & 3)) > > return 0; > > = > > /* Allocate a buffer with enough padding for alignment */ > > - kmalloc_size =3D urb->transfer_buffer_length + > > + kmalloc_size =3D ALIGN(urb->transfer_buffer_length, 4) + > > sizeof(struct ci_hdrc_dma_aligned_buffer) + > > ci_hdrc_usb_dma_align - 1; > > = > = > Would you please explain why you make these changes? Can you point out what's unclear in the commit message? This is to fix a buffer overflow by DMA from the USB controller as it seems to write data 32-bit word at a time. What the patch does is extend the workaround code to account for the extra room needed at the tail of the buffer. Best Regards Micha=B3 Miros=B3aw _______________________________________________ linux-arm-kernel mailing list linux-arm-kernel@lists.infradead.org http://lists.infradead.org/mailman/listinfo/linux-arm-kernel