From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1433951AbdDZA5D (ORCPT ); Tue, 25 Apr 2017 20:57:03 -0400 Received: from mail-qt0-f196.google.com ([209.85.216.196]:36240 "EHLO mail-qt0-f196.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1433932AbdDZA4y (ORCPT ); Tue, 25 Apr 2017 20:56:54 -0400 From: Florian Fainelli To: linux-kernel@vger.kernel.org Cc: Florian Fainelli , Greg Kroah-Hartman , Felipe Balbi , Peter Chen , Roger Quadros , Alan Stern , Mathias Nyman , Javier Martinez Canillas , Baoyou Xie , Sekhar Nori , William wu , Arnd Bergmann , Chris Bainbridge , Wolfram Sang , Krzysztof Opasiak , =?UTF-8?q?Felix=20H=C3=A4dicke?= , Colin Ian King , linux-usb@vger.kernel.org (open list:USB SUBSYSTEM), clemens@ladisch.de, maksim.salau@gmail.com Subject: [PATCH v3 1/2] usb: core: Check URB setup_packet and transfer_buffer sanity Date: Tue, 25 Apr 2017 17:56:11 -0700 Message-Id: <20170426005612.24850-2-f.fainelli@gmail.com> X-Mailer: git-send-email 2.9.3 In-Reply-To: <20170426005612.24850-1-f.fainelli@gmail.com> References: <20170426005612.24850-1-f.fainelli@gmail.com> Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Update usb_hcd_map_urb_for_dma() to check for an URB's setup_packet and transfer_buffer sanity. We first check that urb->setup_packet is neither coming from vmalloc space nor is an on stack buffer, and if that's the case, produce a warning and return an error. For urb->transfer_buffer there is an existing is_vmalloc_addr() check so we just supplement that with an object_is_on_stack() check, produce a warning if that is the case and also return an error. Signed-off-by: Florian Fainelli --- drivers/usb/core/hcd.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/drivers/usb/core/hcd.c b/drivers/usb/core/hcd.c index 49550790a3cb..26d710eec7da 100644 --- a/drivers/usb/core/hcd.c +++ b/drivers/usb/core/hcd.c @@ -26,6 +26,7 @@ #include #include #include +#include #include #include #include @@ -1523,6 +1524,14 @@ int usb_hcd_map_urb_for_dma(struct usb_hcd *hcd, struct urb *urb, if (hcd->self.uses_pio_for_control) return ret; if (IS_ENABLED(CONFIG_HAS_DMA) && hcd->self.uses_dma) { + if (is_vmalloc_addr(urb->setup_packet)) { + WARN_ONCE(1, "setup packet is not dma capable\n"); + return -EAGAIN; + } else if (object_is_on_stack(urb->setup_packet)) { + WARN_ONCE(1, "setup packet is on stack\n"); + return -EAGAIN; + } + urb->setup_dma = dma_map_single( hcd->self.sysdev, urb->setup_packet, @@ -1587,6 +1596,9 @@ int usb_hcd_map_urb_for_dma(struct usb_hcd *hcd, struct urb *urb, } else if (is_vmalloc_addr(urb->transfer_buffer)) { WARN_ONCE(1, "transfer buffer not dma capable\n"); ret = -EAGAIN; + } else if (object_is_on_stack(urb->transfer_buffer)) { + WARN_ONCE(1, "transfer buffer is on stack\n"); + ret = -EAGAIN; } else { urb->transfer_dma = dma_map_single( hcd->self.sysdev, -- 2.9.3