patch "xhci: Fix crash if scatter gather is used with Immediate Data" added to usb-linus

patch "xhci: Fix crash if scatter gather is used with Immediate Data" added to usb-linus

[gregkh]

This is a note to let you know that I've just added the patch titled

    xhci: Fix crash if scatter gather is used with Immediate Data

to my usb git tree which can be found at
    git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git
in the usb-linus branch.

The patch will show up in the next release of the linux-next tree
(usually sometime within the next 24 hours during the week.)

The patch will hopefully also be merged in Linus's tree for the
next -rc kernel release.

If you have any questions about this process, please let me know.


From d39b5bad8658d6d94cb2d98a44a7e159db4f5030 Mon Sep 17 00:00:00 2001
From: Mathias Nyman <mathias.nyman@linux.intel.com>
Date: Thu, 25 Jul 2019 11:54:21 +0300
Subject: xhci: Fix crash if scatter gather is used with Immediate Data
 Transfer (IDT).

A second regression was found in the immediate data transfer (IDT)
support which was added to 5.2 kernel

IDT is used to transfer small amounts of data (up to 8 bytes) in the
field normally used for data dma address, thus avoiding dma mapping.

If the data was not already dma mapped, then IDT support assumed data was
in urb->transfer_buffer, and did not take into accound that even
small amounts of data (8 bytes) can be in a scatterlist instead.

This caused a NULL pointer dereference when sg_dma_len() was used
with non-dma mapped data.

Solve this by not using IDT if scatter gather buffer list is used.

Fixes: 33e39350ebd2 ("usb: xhci: add Immediate Data Transfer support")
Cc: <stable@vger.kernel.org> # v5.2
Reported-by: Maik Stohn <maik.stohn@seal-one.com>
Tested-by: Maik Stohn <maik.stohn@seal-one.com>
CC: Nicolas Saenz Julienne <nsaenzjulienne@suse.de>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Link: https://lore.kernel.org/r/1564044861-1445-1-git-send-email-mathias.nyman@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/host/xhci.h | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h
index 7a264962a1a9..f5c41448d067 100644
--- a/drivers/usb/host/xhci.h
+++ b/drivers/usb/host/xhci.h
@@ -2175,7 +2175,8 @@ static inline bool xhci_urb_suitable_for_idt(struct urb *urb)
 	if (!usb_endpoint_xfer_isoc(&urb->ep->desc) && usb_urb_dir_out(urb) &&
 	    usb_endpoint_maxp(&urb->ep->desc) >= TRB_IDT_MAX_SIZE &&
 	    urb->transfer_buffer_length <= TRB_IDT_MAX_SIZE &&
-	    !(urb->transfer_flags & URB_NO_TRANSFER_DMA_MAP))
+	    !(urb->transfer_flags & URB_NO_TRANSFER_DMA_MAP) &&
+	    !urb->num_sgs)
 		return true;
 
 	return false;
-- 
2.22.0

Re: patch "xhci: Fix crash if scatter gather is used with Immediate Data" added to usb-linus

[Maik Stohn]

[-- Attachment #1: Type: text/plain, Size: 3606 bytes --]

Hello Greg,

Sorry to trouble you again.

I was waiting and observing how the FIX is applied and it looks like it will not be applied to 5.2.x (5.2.3 and 5.2.4 came out without this patch).
Personally I think it is a big mistake not to merge the fix but this is your decision. 

I have to tell my users now to AVOID KERNEL 5.2 at all since it is buggy and most likely will never be fixed.

But since it is also not part of any 5.3 (right now) I'm a bit afraid I also need to put a warning to avoid 5.3 as well.

Would be nice to get an official statement like: "Linux kernel will not merge the USB fix to 5.2, maybe 5.3 will have it, but better wait for 5.4",
so I can quote this to my users.


Best Regards,

Maik Stohn

> Am 25.07.2019 um 11:27 schrieb gregkh@linuxfoundation.org:
> 
> 
> This is a note to let you know that I've just added the patch titled
> 
>    xhci: Fix crash if scatter gather is used with Immediate Data
> 
> to my usb git tree which can be found at
>    git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git
> in the usb-linus branch.
> 
> The patch will show up in the next release of the linux-next tree
> (usually sometime within the next 24 hours during the week.)
> 
> The patch will hopefully also be merged in Linus's tree for the
> next -rc kernel release.
> 
> If you have any questions about this process, please let me know.
> 
> 
> From d39b5bad8658d6d94cb2d98a44a7e159db4f5030 Mon Sep 17 00:00:00 2001
> From: Mathias Nyman <mathias.nyman@linux.intel.com>
> Date: Thu, 25 Jul 2019 11:54:21 +0300
> Subject: xhci: Fix crash if scatter gather is used with Immediate Data
> Transfer (IDT).
> 
> A second regression was found in the immediate data transfer (IDT)
> support which was added to 5.2 kernel
> 
> IDT is used to transfer small amounts of data (up to 8 bytes) in the
> field normally used for data dma address, thus avoiding dma mapping.
> 
> If the data was not already dma mapped, then IDT support assumed data was
> in urb->transfer_buffer, and did not take into accound that even
> small amounts of data (8 bytes) can be in a scatterlist instead.
> 
> This caused a NULL pointer dereference when sg_dma_len() was used
> with non-dma mapped data.
> 
> Solve this by not using IDT if scatter gather buffer list is used.
> 
> Fixes: 33e39350ebd2 ("usb: xhci: add Immediate Data Transfer support")
> Cc: <stable@vger.kernel.org> # v5.2
> Reported-by: Maik Stohn <maik.stohn@seal-one.com>
> Tested-by: Maik Stohn <maik.stohn@seal-one.com>
> CC: Nicolas Saenz Julienne <nsaenzjulienne@suse.de>
> Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
> Link: https://lore.kernel.org/r/1564044861-1445-1-git-send-email-mathias.nyman@linux.intel.com
> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> ---
> drivers/usb/host/xhci.h | 3 ++-
> 1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h
> index 7a264962a1a9..f5c41448d067 100644
> --- a/drivers/usb/host/xhci.h
> +++ b/drivers/usb/host/xhci.h
> @@ -2175,7 +2175,8 @@ static inline bool xhci_urb_suitable_for_idt(struct urb *urb)
> 	if (!usb_endpoint_xfer_isoc(&urb->ep->desc) && usb_urb_dir_out(urb) &&
> 	    usb_endpoint_maxp(&urb->ep->desc) >= TRB_IDT_MAX_SIZE &&
> 	    urb->transfer_buffer_length <= TRB_IDT_MAX_SIZE &&
> -	    !(urb->transfer_flags & URB_NO_TRANSFER_DMA_MAP))
> +	    !(urb->transfer_flags & URB_NO_TRANSFER_DMA_MAP) &&
> +	    !urb->num_sgs)
> 		return true;
> 
> 	return false;
> -- 
> 2.22.0
> 
> 


[-- Attachment #2: smime.p7s --]
[-- Type: application/pkcs7-signature, Size: 4165 bytes --]

Re: patch "xhci: Fix crash if scatter gather is used with Immediate Data" added to usb-linus

[Greg KH]

On Sun, Jul 28, 2019 at 01:25:32PM +0200, Maik Stohn wrote:
> Hello Greg,
> 
> Sorry to trouble you again.
> 
> I was waiting and observing how the FIX is applied and it looks like
> it will not be applied to 5.2.x (5.2.3 and 5.2.4 came out without this
> patch).
> Personally I think it is a big mistake not to merge the fix but this
> is your decision. 
> 
> I have to tell my users now to AVOID KERNEL 5.2 at all since it is
> buggy and most likely will never be fixed.
> 
> But since it is also not part of any 5.3 (right now) I'm a bit afraid
> I also need to put a warning to avoid 5.3 as well.
> 
> Would be nice to get an official statement like: "Linux kernel will
> not merge the USB fix to 5.2, maybe 5.3 will have it, but better wait
> for 5.4", so I can quote this to my users.

How about an official statement like "wait a week please" :)

Or, "if you have problems, please apply this patch."

We _just_ found the fix, it _just_ went into my tree a few days ago.  A
patch can not be in a stable kernel until it shows up in Linus's kernel,
in a release (like a -rc).

So, ideally this patch gets into 5.3-rc2.  Then I can add it to the
queue of patches to go into the 5.2.y release, which should happen
sometime next week or the week after at worst case.

Please read Documentation/process/ for how all of this works if you are
curious, we have tests to pass, releases to make it through, and reviews
to happen here.  Give us a chance please, there is no major rush.  And
if there is a rush, you have the fix to apply to your kernel to solve
the problem!  You are not dependant on any of us here anymore, anyone
can patch their machines if they run into this issue and can not wait a
week or so.

Also, odds are that most people are even running the 5.2.y kernel yet is
pretty low... :)

So, again, patience.  Your fix is just one of hundreds winding its way
through the ether to get out to users.  You are not alone, and at the
same time, not special.  It will happen, just relax.

greg k-h