From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-10.1 required=3.0 tests=DKIMWL_WL_HIGH,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,INCLUDES_PATCH,MAILING_LIST_MULTI,SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 5A827C433E0 for ; Tue, 9 Jun 2020 00:41:58 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 3786E20737 for ; Tue, 9 Jun 2020 00:41:58 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1591663318; bh=TriZ2AXZWfUqYLeoauSonlhvCHyMp9LqIaolwBUV8xM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=sYOfoeiRCwYQnIE8yEbR1GC+pxqmrlZ3vrMzHKNV4n6BrPdo+hJaFar0fr2E6Fj+c AXMd+NlsBAfCGQ73PqLHoVv2NWNSfeXAgyr4TyqmZ+932IZiJxyLcZFRRbil/gPZKz POED6GAzxTankIdUAyxfAZCzQlI1UGvmu1ZJGUQI= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1729560AbgFIAl5 (ORCPT ); Mon, 8 Jun 2020 20:41:57 -0400 Received: from mail.kernel.org ([198.145.29.99]:60204 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1727992AbgFHXMh (ORCPT ); Mon, 8 Jun 2020 19:12:37 -0400 Received: from sasha-vm.mshome.net (c-73-47-72-35.hsd1.nh.comcast.net [73.47.72.35]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id DB33D208C3; Mon, 8 Jun 2020 23:12:35 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1591657956; bh=TriZ2AXZWfUqYLeoauSonlhvCHyMp9LqIaolwBUV8xM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=r0mWaxnkswdbj4ELd00SsmJxMU7+isZTU1NKtgkKdBvd+gM1WxErJJGYfXj4n2qBH 546ZBYmeonNuyVnsqTsslaEunwQMOsgJz9jYNqiEcTF2pfz+vVH42UNuJi1vIljaQ3 7XU7NFZG9an7BGgvAIF98pTIqOqHJMeCsNo0cufA= From: Sasha Levin To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: Greg Kroah-Hartman , Christoph Hellwig , Hillf Danton , Thomas Gleixner , Jeremy Linton , syzbot+353be47c9ce21b68b7ed@syzkaller.appspotmail.com, linux-usb@vger.kernel.org Subject: [PATCH AUTOSEL 5.6 021/606] USB: usbfs: fix mmap dma mismatch Date: Mon, 8 Jun 2020 19:02:26 -0400 Message-Id: <20200608231211.3363633-21-sashal@kernel.org> X-Mailer: git-send-email 2.25.1 In-Reply-To: <20200608231211.3363633-1-sashal@kernel.org> References: <20200608231211.3363633-1-sashal@kernel.org> MIME-Version: 1.0 X-stable: review X-Patchwork-Hint: Ignore Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Greg Kroah-Hartman commit a0e710a7def471b8eb779ff551fc27701da49599 upstream. In commit 2bef9aed6f0e ("usb: usbfs: correct kernel->user page attribute mismatch") we switched from always calling remap_pfn_range() to call dma_mmap_coherent() to handle issues with systems with non-coherent USB host controller drivers. Unfortunatly, as syzbot quickly told us, not all the world is host controllers with DMA support, so we need to check what host controller we are attempting to talk to before doing this type of allocation. Thanks to Christoph for the quick idea of how to fix this. Fixes: 2bef9aed6f0e ("usb: usbfs: correct kernel->user page attribute mismatch") Cc: Christoph Hellwig Cc: Hillf Danton Cc: Thomas Gleixner Cc: Jeremy Linton Cc: stable Reported-by: syzbot+353be47c9ce21b68b7ed@syzkaller.appspotmail.com Reviewed-by: Jeremy Linton Reviewed-by: Christoph Hellwig Link: https://lore.kernel.org/r/20200514112711.1858252-1-gregkh@linuxfoundation.org Signed-off-by: Greg Kroah-Hartman --- drivers/usb/core/devio.c | 16 +++++++++++++--- 1 file changed, 13 insertions(+), 3 deletions(-) diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c index b9db9812d6c5..d93d94d7ff50 100644 --- a/drivers/usb/core/devio.c +++ b/drivers/usb/core/devio.c @@ -251,9 +251,19 @@ static int usbdev_mmap(struct file *file, struct vm_area_struct *vma) usbm->vma_use_count = 1; INIT_LIST_HEAD(&usbm->memlist); - if (dma_mmap_coherent(hcd->self.sysdev, vma, mem, dma_handle, size)) { - dec_usb_memory_use_count(usbm, &usbm->vma_use_count); - return -EAGAIN; + if (hcd->localmem_pool || !hcd_uses_dma(hcd)) { + if (remap_pfn_range(vma, vma->vm_start, + virt_to_phys(usbm->mem) >> PAGE_SHIFT, + size, vma->vm_page_prot) < 0) { + dec_usb_memory_use_count(usbm, &usbm->vma_use_count); + return -EAGAIN; + } + } else { + if (dma_mmap_coherent(hcd->self.sysdev, vma, mem, dma_handle, + size)) { + dec_usb_memory_use_count(usbm, &usbm->vma_use_count); + return -EAGAIN; + } } vma->vm_flags |= VM_IO; -- 2.25.1