From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 492FA442370; Mon, 17 Aug 2026 15:16:37 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786979800; cv=none; b=Uo+2HI5QDXAnin8QbsT5by7LVA1UW4o909SOasofVJ8fgPZDKhc1Z4380ab8K+Hr6Qx8fmATuJpCTUPA38sehrhSv1yPD0PrY0x0zwKCNCom7TvNV0P7u4b05/vo6zdHwWbcVbkuPzLqdLsH21favVQoSJ2SQIBkBB7ESSCcib0= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786979800; c=relaxed/simple; bh=P7NKnc3rA79cTYu0YoUekNWBuN2TObHVzWM42LloWAs=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=AQiIQxvyRwh1caWC+MHAwLqpM9U9D9/QVW5qt6uEMkwARgQcVflIZ3/RQsSCSSjGYy5h/iYmSJ/MbfOaPkumBGcpRxwu0icGhpcOTDuxUW9vnwGwFtfknu2qSpwxJOipYUdAtOFQ8/OY6kqdoC8AYPbYfFD6teSP4seLxmMd7r0= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=MWdoySJD; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="MWdoySJD" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 751831F00A3A; Mon, 17 Aug 2026 15:16:34 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1786979795; bh=TtdkyhI7GsonkV6pkomUBIKj4OLFl4gdcT2wZxTRA5I=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=MWdoySJDoppvH0ttEpo/flSKZoIRoJgzsD1OJUS87UYhnXIJjMomI5g66894Za8Mn Eu9xvO/CvUtyQpFXR2+eD4VGGfTdAYw4jOIkneLfkkgqDEA7+DzXNDdbYxjMD+pVZQ zBXEns2zZTT0TxUEwBIrW7xRXMAHIx6J4hQ4oNfY= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Sashiko , Aleksandr Mezin , Guenter Roeck , Sasha Levin Subject: [PATCH 6.1 349/609] hwmon: (nzxt-smart2) DMA-align output buffer Date: Mon, 17 Aug 2026 15:30:45 +0200 Message-ID: <20260817132555.951577840@linuxfoundation.org> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260817132543.039278408@linuxfoundation.org> References: <20260817132543.039278408@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: patches@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.1-stable review patch. If anyone has any objections, please let me know. ------------------ From: Guenter Roeck [ Upstream commit 080bbf42faf77e6489ab30d5114c5f8f6ccbb1b8 ] Sashiko reports: When send_output_report() calls hid_hw_output_report(), the underlying USB HID core calls usb_interrupt_msg() which maps this buffer directly for DMA. When the DMA mapping flushes or invalidates the cacheline, it will corrupt the adjacent variables (mutex, update_interval) that were modified concurrently by the CPU. This causes memory corruption due to cacheline sharing on non-coherent CPU architectures (such as ARM or MIPS). The DMA API debugging tool (CONFIG_DMA_API_DEBUG) will trigger runtime warnings for this violation. Any operation that triggers send_output_report() (like setting a fan speed or updating the interval) causes the USB DMA mapping. On systems with non-coherent caches, this structural bug causes immediate and deterministic memory corruption. Align the output buffer to ARCH_DMA_MINALIGN to fix the problem. Reported-by: Sashiko Fixes: 53e68c20aeb1 ("hwmon: add driver for NZXT RGB&Fan Controller/Smart Device v2.") Cc: Aleksandr Mezin Signed-off-by: Guenter Roeck Signed-off-by: Sasha Levin --- drivers/hwmon/nzxt-smart2.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/hwmon/nzxt-smart2.c b/drivers/hwmon/nzxt-smart2.c index 02816538d18eb..90df6a7fc88d7 100644 --- a/drivers/hwmon/nzxt-smart2.c +++ b/drivers/hwmon/nzxt-smart2.c @@ -203,7 +203,7 @@ struct drvdata { */ struct mutex mutex; long update_interval; - u8 output_buffer[OUTPUT_REPORT_SIZE]; + u8 output_buffer[OUTPUT_REPORT_SIZE] __aligned(ARCH_DMA_MINALIGN); }; static long scale_pwm_value(long val, long orig_max, long new_max) -- 2.53.0