From: Ben Hutchings <ben@decadent.org.uk>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: akpm@linux-foundation.org,
"Mauro Carvalho Chehab" <mchehab@s-opensource.com>,
"Michele Baldessari" <michele@acksyn.org>
Subject: [PATCH 3.2 28/79] media: Don't do DMA on stack for firmware upload in the AS102 driver
Date: Sun, 11 Feb 2018 04:20:06 +0000 [thread overview]
Message-ID: <lsq.1518322806.130883530@decadent.org.uk> (raw)
In-Reply-To: <lsq.1518322802.943358572@decadent.org.uk>
3.2.99-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Michele Baldessari <michele@acksyn.org>
commit b3120d2cc447ee77b9d69bf4ad7b452c9adb4d39 upstream.
Firmware load on AS102 is using the stack which is not allowed any
longer. We currently fail with:
kernel: transfer buffer not dma capable
kernel: ------------[ cut here ]------------
kernel: WARNING: CPU: 0 PID: 598 at drivers/usb/core/hcd.c:1595 usb_hcd_map_urb_for_dma+0x41d/0x620
kernel: Modules linked in: amd64_edac_mod(-) edac_mce_amd as102_fe dvb_as102(+) kvm_amd kvm snd_hda_codec_realtek dvb_core snd_hda_codec_generic snd_hda_codec_hdmi snd_hda_intel snd_hda_codec irqbypass crct10dif_pclmul crc32_pclmul snd_hda_core snd_hwdep snd_seq ghash_clmulni_intel sp5100_tco fam15h_power wmi k10temp i2c_piix4 snd_seq_device snd_pcm snd_timer parport_pc parport tpm_infineon snd tpm_tis soundcore tpm_tis_core tpm shpchp acpi_cpufreq xfs libcrc32c amdgpu amdkfd amd_iommu_v2 radeon hid_logitech_hidpp i2c_algo_bit drm_kms_helper crc32c_intel ttm drm r8169 mii hid_logitech_dj
kernel: CPU: 0 PID: 598 Comm: systemd-udevd Not tainted 4.13.10-200.fc26.x86_64 #1
kernel: Hardware name: ASUS All Series/AM1I-A, BIOS 0505 03/13/2014
kernel: task: ffff979933b24c80 task.stack: ffffaf83413a4000
kernel: RIP: 0010:usb_hcd_map_urb_for_dma+0x41d/0x620
systemd-fsck[659]: /dev/sda2: clean, 49/128016 files, 268609/512000 blocks
kernel: RSP: 0018:ffffaf83413a7728 EFLAGS: 00010282
systemd-udevd[604]: link_config: autonegotiation is unset or enabled, the speed and duplex are not writable.
kernel: RAX: 000000000000001f RBX: ffff979930bce780 RCX: 0000000000000000
kernel: RDX: 0000000000000000 RSI: ffff97993ec0e118 RDI: ffff97993ec0e118
kernel: RBP: ffffaf83413a7768 R08: 000000000000039a R09: 0000000000000000
kernel: R10: 0000000000000001 R11: 00000000ffffffff R12: 00000000fffffff5
kernel: R13: 0000000001400000 R14: 0000000000000001 R15: ffff979930806800
kernel: FS: 00007effaca5c8c0(0000) GS:ffff97993ec00000(0000) knlGS:0000000000000000
kernel: CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
kernel: CR2: 00007effa9fca962 CR3: 0000000233089000 CR4: 00000000000406f0
kernel: Call Trace:
kernel: usb_hcd_submit_urb+0x493/0xb40
kernel: ? page_cache_tree_insert+0x100/0x100
kernel: ? xfs_iunlock+0xd5/0x100 [xfs]
kernel: ? xfs_file_buffered_aio_read+0x57/0xc0 [xfs]
kernel: usb_submit_urb+0x22d/0x560
kernel: usb_start_wait_urb+0x6e/0x180
kernel: usb_bulk_msg+0xb8/0x160
kernel: as102_send_ep1+0x49/0xe0 [dvb_as102]
kernel: ? devres_add+0x3f/0x50
kernel: as102_firmware_upload.isra.0+0x1dc/0x210 [dvb_as102]
kernel: as102_fw_upload+0xb6/0x1f0 [dvb_as102]
kernel: as102_dvb_register+0x2af/0x2d0 [dvb_as102]
kernel: as102_usb_probe+0x1f3/0x260 [dvb_as102]
kernel: usb_probe_interface+0x124/0x300
kernel: driver_probe_device+0x2ff/0x450
kernel: __driver_attach+0xa4/0xe0
kernel: ? driver_probe_device+0x450/0x450
kernel: bus_for_each_dev+0x6e/0xb0
kernel: driver_attach+0x1e/0x20
kernel: bus_add_driver+0x1c7/0x270
kernel: driver_register+0x60/0xe0
kernel: usb_register_driver+0x81/0x150
kernel: ? 0xffffffffc0807000
kernel: as102_usb_driver_init+0x1e/0x1000 [dvb_as102]
kernel: do_one_initcall+0x50/0x190
kernel: ? __vunmap+0x81/0xb0
kernel: ? kfree+0x154/0x170
kernel: ? kmem_cache_alloc_trace+0x15f/0x1c0
kernel: ? do_init_module+0x27/0x1e9
kernel: do_init_module+0x5f/0x1e9
kernel: load_module+0x2602/0x2c30
kernel: SYSC_init_module+0x170/0x1a0
kernel: ? SYSC_init_module+0x170/0x1a0
kernel: SyS_init_module+0xe/0x10
kernel: do_syscall_64+0x67/0x140
kernel: entry_SYSCALL64_slow_path+0x25/0x25
kernel: RIP: 0033:0x7effab6cf3ea
kernel: RSP: 002b:00007fff5cfcbbc8 EFLAGS: 00000246 ORIG_RAX: 00000000000000af
kernel: RAX: ffffffffffffffda RBX: 00005569e0b83760 RCX: 00007effab6cf3ea
kernel: RDX: 00007effac2099c5 RSI: 0000000000009a13 RDI: 00005569e0b98c50
kernel: RBP: 00007effac2099c5 R08: 00005569e0b83ed0 R09: 0000000000001d80
kernel: R10: 00007effab98db00 R11: 0000000000000246 R12: 00005569e0b98c50
kernel: R13: 00005569e0b81c60 R14: 0000000000020000 R15: 00005569dfadfdf7
kernel: Code: 48 39 c8 73 30 80 3d 59 60 9d 00 00 41 bc f5 ff ff ff 0f 85 26 ff ff ff 48 c7 c7 b8 6b d0 92 c6 05 3f 60 9d 00 01 e8 24 3d ad ff <0f> ff 8b 53 64 e9 09 ff ff ff 65 48 8b 0c 25 00 d3 00 00 48 8b
kernel: ---[ end trace c4cae366180e70ec ]---
kernel: as10x_usb: error during firmware upload part1
Let's allocate the the structure dynamically so we can get the firmware
loaded correctly:
[ 14.243057] as10x_usb: firmware: as102_data1_st.hex loaded with success
[ 14.500777] as10x_usb: firmware: as102_data2_st.hex loaded with success
Signed-off-by: Michele Baldessari <michele@acksyn.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
[bwh: Backported to 3.2: adjust filename, context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/staging/media/as102/as102_fw.c | 28 +++++++++++++++++-----------
1 file changed, 17 insertions(+), 11 deletions(-)
--- a/drivers/staging/media/as102/as102_fw.c
+++ b/drivers/staging/media/as102/as102_fw.c
@@ -106,20 +106,25 @@ static int as102_firmware_upload(struct
unsigned char *cmd,
const struct firmware *firmware) {
- struct as10x_fw_pkt_t fw_pkt;
+ struct as10x_fw_pkt_t *fw_pkt;
int total_read_bytes = 0, errno = 0;
unsigned char addr_has_changed = 0;
ENTER();
+ fw_pkt = kmalloc(sizeof(*fw_pkt), GFP_KERNEL);
+ if (!fw_pkt)
+ return -ENOMEM;
+
+
for (total_read_bytes = 0; total_read_bytes < firmware->size; ) {
int read_bytes = 0, data_len = 0;
/* parse intel hex line */
read_bytes = parse_hex_line(
(u8 *) (firmware->data + total_read_bytes),
- fw_pkt.raw.address,
- fw_pkt.raw.data,
+ fw_pkt->raw.address,
+ fw_pkt->raw.data,
&data_len,
&addr_has_changed);
@@ -129,28 +134,28 @@ static int as102_firmware_upload(struct
/* detect the end of file */
total_read_bytes += read_bytes;
if (total_read_bytes == firmware->size) {
- fw_pkt.u.request[0] = 0x00;
- fw_pkt.u.request[1] = 0x03;
+ fw_pkt->u.request[0] = 0x00;
+ fw_pkt->u.request[1] = 0x03;
/* send EOF command */
errno = bus_adap->ops->upload_fw_pkt(bus_adap,
(uint8_t *)
- &fw_pkt, 2, 0);
+ fw_pkt, 2, 0);
if (errno < 0)
goto error;
} else {
if (!addr_has_changed) {
/* prepare command to send */
- fw_pkt.u.request[0] = 0x00;
- fw_pkt.u.request[1] = 0x01;
+ fw_pkt->u.request[0] = 0x00;
+ fw_pkt->u.request[1] = 0x01;
- data_len += sizeof(fw_pkt.u.request);
- data_len += sizeof(fw_pkt.raw.address);
+ data_len += sizeof(fw_pkt->u.request);
+ data_len += sizeof(fw_pkt->raw.address);
/* send cmd to device */
errno = bus_adap->ops->upload_fw_pkt(bus_adap,
(uint8_t *)
- &fw_pkt,
+ fw_pkt,
data_len,
0);
if (errno < 0)
@@ -159,6 +164,7 @@ static int as102_firmware_upload(struct
}
}
error:
+ kfree(fw_pkt);
LEAVE();
return (errno == 0) ? total_read_bytes : errno;
}
next prev parent reply other threads:[~2018-02-11 4:20 UTC|newest]
Thread overview: 85+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-02-11 4:20 [PATCH 3.2 00/79] 3.2.99-rc1 review Ben Hutchings
2018-02-11 4:20 ` [PATCH 3.2 29/79] x86/smp: Don't ever patch back to UP if we unplug cpus Ben Hutchings
2018-02-11 4:20 ` [PATCH 3.2 50/79] autofs4: catatonic_mode vs. notify_daemon race Ben Hutchings
2018-02-11 4:20 ` [PATCH 3.2 38/79] ocfs2: fix issue that ocfs2_setattr() does not deal with new_i_size==i_size Ben Hutchings
2018-02-11 4:20 ` [PATCH 3.2 44/79] dm: discard support requires all targets in a table support discards Ben Hutchings
2018-02-11 4:20 ` [PATCH 3.2 52/79] autofs: fix careless error in recent commit Ben Hutchings
2018-02-11 4:20 ` [PATCH 3.2 23/79] mtd: nand: Fix writing mtdoops to nand flash Ben Hutchings
2018-02-11 4:20 ` [PATCH 3.2 39/79] ocfs2: should wait dio before inode lock in ocfs2_setattr() Ben Hutchings
2018-02-11 7:39 ` alex chen
2018-02-11 18:01 ` Ben Hutchings
2018-02-11 4:20 ` [PATCH 3.2 33/79] rt2x00usb: mark device removed when get ENOENT usb error Ben Hutchings
2018-02-11 4:20 ` [PATCH 3.2 48/79] nfs: Fix ugly referral attributes Ben Hutchings
2018-02-11 4:20 ` [PATCH 3.2 22/79] media: omap_vout: Fix a possible null pointer dereference in omap_vout_open() Ben Hutchings
2018-02-11 4:20 ` [PATCH 3.2 59/79] ALSA: hda: Add Raven PCI ID Ben Hutchings
2018-02-11 4:20 ` [PATCH 3.2 31/79] USB: usbfs: compute urb->actual_length for isochronous Ben Hutchings
2018-02-11 4:20 ` [PATCH 3.2 09/79] scsi: bfa: integer overflow in debugfs Ben Hutchings
2018-02-11 4:20 ` [PATCH 3.2 05/79] USB: serial: garmin_gps: fix I/O after failed probe and remove Ben Hutchings
2018-02-11 4:20 ` [PATCH 3.2 27/79] eCryptfs: use after free in ecryptfs_release_messaging() Ben Hutchings
2018-02-11 4:20 ` [PATCH 3.2 02/79] rtc: interface: ignore expired timers when enqueuing new timers Ben Hutchings
2018-02-11 4:20 ` [PATCH 3.2 41/79] sctp: Fixup v4mapped behaviour to comply with Sock API Ben Hutchings
2018-02-11 4:20 ` [PATCH 3.2 07/79] media: rc: check for integer overflow Ben Hutchings
2018-02-11 4:20 ` [PATCH 3.2 26/79] coda: fix 'kernel memory exposure attempt' in fsync Ben Hutchings
2018-02-11 4:20 ` [PATCH 3.2 76/79] usbip: fix stub_send_ret_submit() vulnerability to null transfer_buffer Ben Hutchings
2018-02-11 4:20 ` Ben Hutchings [this message]
2018-02-11 4:20 ` [PATCH 3.2 32/79] video: udlfb: Fix read EDID timeout Ben Hutchings
2018-02-11 4:20 ` [PATCH 3.2 13/79] net/9p: Switch to wait_event_killable() Ben Hutchings
2018-02-11 4:20 ` [PATCH 3.2 01/79] Input: adxl34x - do not treat FIFO_MODE() as boolean Ben Hutchings
2018-02-11 4:20 ` [PATCH 3.2 16/79] l2tp: push all ppp pseudowire shutdown through .release handler Ben Hutchings
2018-02-11 4:20 ` [PATCH 3.2 10/79] IB/srp: Avoid that a cable pull can trigger a kernel crash Ben Hutchings
2018-02-11 4:20 ` [PATCH 3.2 46/79] KVM: vmx: Inject #GP on invalid PAT CR Ben Hutchings
2018-02-11 4:20 ` [PATCH 3.2 19/79] l2tp: initialise l2tp_eth sessions before registering them Ben Hutchings
2018-02-11 4:20 ` [PATCH 3.2 12/79] fs/9p: Compare qid.path in v9fs_test_inode Ben Hutchings
2018-02-11 4:20 ` [PATCH 3.2 54/79] ALSA: timer: Remove kernel warning at compat ioctl error paths Ben Hutchings
2018-02-11 4:20 ` [PATCH 3.2 55/79] ALSA: usb-audio: Add sanity checks to FE parser Ben Hutchings
2018-02-11 4:20 ` [PATCH 3.2 42/79] sctp: fully initialize the IPv6 address in sctp_v6_to_addr() Ben Hutchings
2018-02-11 4:20 ` [PATCH 3.2 47/79] KVM: SVM: obey guest PAT Ben Hutchings
2018-02-11 4:20 ` [PATCH 3.2 73/79] usbip: fix stub_rx: get_pipe() to validate endpoint number Ben Hutchings
2018-02-11 4:20 ` [PATCH 3.2 78/79] kaiser: Set _PAGE_NX only if supported Ben Hutchings
2018-02-11 4:20 ` [PATCH 3.2 71/79] usbip: Fix sscanf handling Ben Hutchings
2018-02-11 4:20 ` [PATCH 3.2 74/79] usbip: fix stub_rx: harden CMD_SUBMIT path to handle malicious input Ben Hutchings
2018-02-11 4:20 ` [PATCH 3.2 17/79] l2tp: ensure sessions are freed after their PPPOL2TP socket Ben Hutchings
2018-02-11 4:20 ` [PATCH 3.2 35/79] blktrace: Fix potential deadlock between delete & sysfs ops Ben Hutchings
2018-02-11 4:20 ` [PATCH 3.2 25/79] USB: Add delay-init quirk for Corsair K70 LUX keyboards Ben Hutchings
2018-02-11 4:20 ` [PATCH 3.2 49/79] autofs4: autofs4_wait() vs. autofs4_catatonic_mode() race Ben Hutchings
2018-02-11 4:20 ` [PATCH 3.2 34/79] dm: fix race between dm_get_from_kobject() and __dm_destroy() Ben Hutchings
2018-02-11 4:20 ` [PATCH 3.2 64/79] netfilter: xt_TCPMSS: fix handling of malformed TCP header and options Ben Hutchings
2018-02-11 4:20 ` [PATCH 3.2 77/79] [media] cx231xx: Fix the max number of interfaces Ben Hutchings
2018-02-11 4:20 ` [PATCH 3.2 65/79] netfilter: xt_TCPMSS: correct return value in tcpmss_mangle_packet Ben Hutchings
2018-02-11 4:20 ` [PATCH 3.2 72/79] usb: add helper to extract bits 12:11 of wMaxPacketSize Ben Hutchings
2018-02-11 4:20 ` [PATCH 3.2 11/79] tpm-dev-common: Reject too short writes Ben Hutchings
2018-02-11 4:20 ` [PATCH 3.2 04/79] PCI/AER: Report non-fatal errors only to the affected endpoint Ben Hutchings
2018-02-11 4:20 ` [PATCH 3.2 69/79] ALSA: seq: Make ioctls race-free Ben Hutchings
2018-02-11 4:20 ` [PATCH 3.2 14/79] l2tp: add session reorder queue purge function to core Ben Hutchings
2018-02-11 4:20 ` [PATCH 3.2 43/79] net/sctp: Always set scope_id in sctp_inet6_skb_msgname Ben Hutchings
2018-02-11 4:20 ` [PATCH 3.2 21/79] l2tp: initialise PPP sessions before registering them Ben Hutchings
2018-02-11 4:20 ` [PATCH 3.2 45/79] dm bufio: fix integer overflow when limiting maximum cache size Ben Hutchings
2018-02-11 4:20 ` [PATCH 3.2 51/79] autofs: don't fail mount for transient error Ben Hutchings
2018-02-11 4:20 ` [PATCH 3.2 62/79] netfilter: xt_TCPOPTSTRIP: don't use tcp_hdr() Ben Hutchings
2018-02-11 4:20 ` [PATCH 3.2 06/79] USB: serial: garmin_gps: fix memory leak on probe errors Ben Hutchings
2018-02-11 4:20 ` [PATCH 3.2 20/79] l2tp: protect sock pointer of struct pppol2tp_session with RCU Ben Hutchings
2018-02-11 4:20 ` [PATCH 3.2 60/79] x86/decoder: Add new TEST instruction pattern Ben Hutchings
2018-02-11 4:20 ` [PATCH 3.2 79/79] kaiser: Set _PAGE_NX only if supported Ben Hutchings
2018-02-11 4:20 ` [PATCH 3.2 18/79] l2tp: don't register sessions in l2tp_session_create() Ben Hutchings
2018-02-11 4:20 ` [PATCH 3.2 03/79] rtc: set the alarm to the next expiring timer Ben Hutchings
2018-02-11 4:20 ` [PATCH 3.2 63/79] netfilter: xt_TCPMSS: Fix missing fragmentation handling Ben Hutchings
2018-02-11 4:20 ` [PATCH 3.2 24/79] isofs: fix timestamps beyond 2027 Ben Hutchings
2018-02-11 4:20 ` [PATCH 3.2 61/79] netfilter: xt_TCPOPTSTRIP: fix possible mangling beyond packet boundary Ben Hutchings
2018-02-11 4:20 ` [PATCH 3.2 56/79] ALSA: usb-audio: Fix potential out-of-bound access at parsing SU Ben Hutchings
2018-02-11 4:20 ` [PATCH 3.2 37/79] IB/mlx4: Increase maximal message size under UD QP Ben Hutchings
2018-02-11 4:20 ` [PATCH 3.2 58/79] ALSA: usb-audio: Add sanity checks in v2 clock parsers Ben Hutchings
2018-02-11 4:20 ` [PATCH 3.2 53/79] nilfs2: fix race condition that causes file system corruption Ben Hutchings
2018-02-11 4:20 ` [PATCH 3.2 30/79] kprobes, x86/alternatives: Use text_mutex to protect smp_alt_modules Ben Hutchings
2018-02-11 4:20 ` [PATCH 3.2 75/79] usbip: prevent vhci_hcd driver from leaking a socket pointer address Ben Hutchings
2018-02-11 4:20 ` [PATCH 3.2 40/79] s390/disassembler: increase show_code buffer size Ben Hutchings
2018-02-11 4:20 ` [PATCH 3.2 15/79] l2tp: purge session reorder queue on delete Ben Hutchings
2018-02-11 4:20 ` [PATCH 3.2 66/79] netfilter: xt_TCPMSS: add more sanity tests on tcph->doff Ben Hutchings
2018-02-11 4:20 ` [PATCH 3.2 68/79] RDS: null pointer dereference in rds_atomic_free_op Ben Hutchings
2018-02-11 4:20 ` [PATCH 3.2 70/79] staging: usbip: removed #if 0'd out code Ben Hutchings
2018-02-11 4:20 ` [PATCH 3.2 08/79] KVM: nVMX: set IDTR and GDTR limits when loading L1 host state Ben Hutchings
2018-02-11 4:20 ` [PATCH 3.2 36/79] blktrace: fix unlocked access to init/start-stop/teardown Ben Hutchings
2018-02-11 4:20 ` [PATCH 3.2 57/79] ALSA: usb-audio: Fix potential zero-division at parsing FU Ben Hutchings
2018-02-12 6:59 ` Takashi Iwai
2018-02-13 18:28 ` Ben Hutchings
2018-02-11 4:20 ` [PATCH 3.2 67/79] RDS: Heap OOB write in rds_message_alloc_sgs() Ben Hutchings
2018-02-11 11:18 ` [PATCH 3.2 00/79] 3.2.99-rc1 review Guenter Roeck
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=lsq.1518322806.130883530@decadent.org.uk \
--to=ben@decadent.org.uk \
--cc=akpm@linux-foundation.org \
--cc=linux-kernel@vger.kernel.org \
--cc=mchehab@s-opensource.com \
--cc=michele@acksyn.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox