From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 6787732144F; Tue, 26 Aug 2025 11:29:59 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1756207799; cv=none; b=BrCRMmNZ94bzZMUI769BzAQ4MPCqmpPIBu/VYr/xG9hDXoWhbnRgukLQyY4VIgzIi1RiREF6bME2fmMZKi85CJKNZ2Xs34D9hdlaf7x5rwV3amMaooZT+b5F51iACVitfWy8hoyCdNgZdfK+BVyYt9sing7kOyo63hqi3ZrbC3A= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1756207799; c=relaxed/simple; bh=BPkMZuIWuco2pyGPWmdfQ16c4QhJ+qt6IpC/nx403i8=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=oUpq2NHnFJSJc4w+k1UMsCMEpo4WEZeJkryX9HP2sRbC4bQhZrhkSyJ3k3OcohQVOle09DI1rWdfHKNOaEX2UtSiWDbTutClIHdNawbFpmsDIF6r9BOG6YHs3H4t7PG20cpS6qluWWRoiF8gAD1F/lirE8BeD1ZDGtBvWHaXWz0= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=0XAxPNlE; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="0XAxPNlE" Received: by smtp.kernel.org (Postfix) with ESMTPSA id AC84BC4CEF1; Tue, 26 Aug 2025 11:29:58 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1756207799; bh=BPkMZuIWuco2pyGPWmdfQ16c4QhJ+qt6IpC/nx403i8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=0XAxPNlEAOOEJ7/kF4814JTmdGJJZJd4arzi7xx+FuwtT48hVUSsRPBp+Coiq2/zU FyI3sBmzEWiQMVYeaxoJBbOXApfOEZYqXtjsmeKxSJaOH9FpWw+HwG4Slu+DdSxCoh ce4mL5p9L8nD3aKixLXruhsDi0oQS7EE67y8SQb4= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, stable , Jun Li , Xu Yang , Alan Stern Subject: [PATCH 6.16 314/457] usb: core: hcd: fix accessing unmapped memory in SINGLE_STEP_SET_FEATURE test Date: Tue, 26 Aug 2025 13:09:58 +0200 Message-ID: <20250826110945.120158170@linuxfoundation.org> X-Mailer: git-send-email 2.50.1 In-Reply-To: <20250826110937.289866482@linuxfoundation.org> References: <20250826110937.289866482@linuxfoundation.org> User-Agent: quilt/0.68 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: patches@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.16-stable review patch. If anyone has any objections, please let me know. ------------------ From: Xu Yang commit 8fe06185e11ae753414aa6117f0e798aa77567ff upstream. The USB core will unmap urb->transfer_dma after SETUP stage completes. Then the USB controller will access unmapped memory when it received device descriptor. If iommu is equipped, the entire test can't be completed due to the memory accessing is blocked. Fix it by calling map_urb_for_dma() again for IN stage. To reduce redundant map for urb->transfer_buffer, this will also set URB_NO_TRANSFER_DMA_MAP flag before first map_urb_for_dma() to skip dma map for urb->transfer_buffer and clear URB_NO_TRANSFER_DMA_MAP flag before second map_urb_for_dma(). Fixes: 216e0e563d81 ("usb: core: hcd: use map_urb_for_dma for single step set feature urb") Cc: stable Reviewed-by: Jun Li Signed-off-by: Xu Yang Acked-by: Alan Stern Link: https://lore.kernel.org/r/20250806083955.3325299-1-xu.yang_2@nxp.com Signed-off-by: Greg Kroah-Hartman --- drivers/usb/core/hcd.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) --- a/drivers/usb/core/hcd.c +++ b/drivers/usb/core/hcd.c @@ -2151,7 +2151,7 @@ static struct urb *request_single_step_s urb->complete = usb_ehset_completion; urb->status = -EINPROGRESS; urb->actual_length = 0; - urb->transfer_flags = URB_DIR_IN; + urb->transfer_flags = URB_DIR_IN | URB_NO_TRANSFER_DMA_MAP; usb_get_urb(urb); atomic_inc(&urb->use_count); atomic_inc(&urb->dev->urbnum); @@ -2215,9 +2215,15 @@ int ehset_single_step_set_feature(struct /* Complete remaining DATA and STATUS stages using the same URB */ urb->status = -EINPROGRESS; + urb->transfer_flags &= ~URB_NO_TRANSFER_DMA_MAP; usb_get_urb(urb); atomic_inc(&urb->use_count); atomic_inc(&urb->dev->urbnum); + if (map_urb_for_dma(hcd, urb, GFP_KERNEL)) { + usb_put_urb(urb); + goto out1; + } + retval = hcd->driver->submit_single_step_set_feature(hcd, urb, 0); if (!retval && !wait_for_completion_timeout(&done, msecs_to_jiffies(2000))) {