From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <linux-kernel-owner@vger.kernel.org>
Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
        id S1434127AbdDZBDr (ORCPT <rfc822;w@1wt.eu>);
        Tue, 25 Apr 2017 21:03:47 -0400
Received: from mail-qt0-f193.google.com ([209.85.216.193]:35715 "EHLO
        mail-qt0-f193.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org
        with ESMTP id S1434110AbdDZBDf (ORCPT
        <rfc822;linux-kernel@vger.kernel.org>);
        Tue, 25 Apr 2017 21:03:35 -0400
From: Florian Fainelli <f.fainelli@gmail.com>
To: linux-kernel@vger.kernel.org
Cc: Florian Fainelli <f.fainelli@gmail.com>,
        Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
        Felipe Balbi <balbi@kernel.org>, Peter Chen <peter.chen@nxp.com>,
        Roger Quadros <rogerq@ti.com>, Alan Stern <stern@rowland.harvard.edu>,
        Mathias Nyman <mathias.nyman@linux.intel.com>,
        Javier Martinez Canillas <javier@osg.samsung.com>,
        Baoyou Xie <baoyou.xie@linaro.org>, Sekhar Nori <nsekhar@ti.com>,
        William wu <wulf@rock-chips.com>, Arnd Bergmann <arnd@arndb.de>,
        Chris Bainbridge <chris.bainbridge@gmail.com>,
        Wolfram Sang <wsa-dev@sang-engineering.com>,
        Krzysztof Opasiak <k.opasiak@samsung.com>,
        =?UTF-8?q?Felix=20H=C3=A4dicke?= <felixhaedicke@web.de>,
        Colin Ian King <colin.king@canonical.com>,
        linux-usb@vger.kernel.org (open list:USB SUBSYSTEM),
        clemens@ladisch.de, maksim.salau@gmail.com
Subject: [PATCH v3 2/2] usb: udc: core: Error if req->buf is either from vmalloc or stack
Date: Tue, 25 Apr 2017 17:56:12 -0700
Message-Id: <20170426005612.24850-3-f.fainelli@gmail.com>
X-Mailer: git-send-email 2.9.3
In-Reply-To: <20170426005612.24850-1-f.fainelli@gmail.com>
References: <20170426005612.24850-1-f.fainelli@gmail.com>
Sender: linux-kernel-owner@vger.kernel.org
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

Check that req->buf is a valid DMA capable address, produce a warning
and return an error if it's either coming from vmalloc space or is an on
stack buffer.

Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
---
 drivers/usb/gadget/udc/core.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/drivers/usb/gadget/udc/core.c b/drivers/usb/gadget/udc/core.c
index efce68e9a8e0..a03aec574f64 100644
--- a/drivers/usb/gadget/udc/core.c
+++ b/drivers/usb/gadget/udc/core.c
@@ -23,6 +23,7 @@
 #include <linux/list.h>
 #include <linux/err.h>
 #include <linux/dma-mapping.h>
+#include <linux/sched/task_stack.h>
 #include <linux/workqueue.h>
 
 #include <linux/usb/ch9.h>
@@ -798,6 +799,14 @@ int usb_gadget_map_request_by_dev(struct device *dev,
 
 		req->num_mapped_sgs = mapped;
 	} else {
+		if (is_vmalloc_addr(req->buf)) {
+			dev_err(dev, "buffer is not dma capable\n");
+			return -EFAULT;
+		} else if (object_is_on_stack(req->buf)) {
+			dev_err(dev, "buffer is on stack\n");
+			return -EFAULT;
+		}
+
 		req->dma = dma_map_single(dev, req->buf, req->length,
 				is_in ? DMA_TO_DEVICE : DMA_FROM_DEVICE);
 
-- 
2.9.3