Received: by 2002:ad5:474a:0:0:0:0:0 with SMTP id i10csp3485169imu; Sun, 11 Nov 2018 16:09:58 -0800 (PST) X-Google-Smtp-Source: AJdET5esxHM3EJ9IlI7uiu0USLliFyLO57OJSJ/01ceQ44Ya3mnFBpP00t6pBn9/Ne4AORD1QRVI X-Received: by 2002:a63:be4d:: with SMTP id g13mr15753142pgo.378.1541981398219; Sun, 11 Nov 2018 16:09:58 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1541981398; cv=none; d=google.com; s=arc-20160816; b=fTqjDVIVcwlTuzNiW08m4Hc9+MEtEJPE8LgOyJoKhZNwq8U+gKqHHePhztfmS4+75c OLWs0ggxgJsJhlwDOkGaKxfTif0a82AHhmoWZoqKfTCWbM/ihop8qGiRpV+ddwA/c9aL i+gmGuDNVrfMaJGVdI+Le0LZjyzs40gVtbYbL3Prwt2lxMrsVkF8EKwZYBxHDxCyIKJB JVulqw0hdh3OT8l/mcEFOTmbsSOvPFtYI+nBJ0NWygPUewkVLSF5WSEaD7RscwvQ7EWH 3UeFFHdTMVhRJthvsUnou4ZC8RymFwiwH2nMpqd1flQBeuQs7nZ333xhsTmesu0JVgw0 qwOw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=3eRumWDB3RKxxbHqvDIQYm5tKXe2/NewDBkwvSuneeo=; b=decmp6gOLAPoudwqs5bbkkg/MafsAOObq271QeOfOo7duB+9CTRTk1HUOF7nDyXdOZ tklOArmgd9Vxaxxy+m57knQVwCp4HBlh4ZIIpTtSAPKVakNczOY8tjuiVGU6J2FXnCGd 1TUiPV9Mg57WHJBJx0MEq3XpI8zejS/lv2DbqPQazmDej/MRmIywXFBVidBOyZX8vRtf 1zY+HsoqP/o00JWoqbKHwaemCvdqnImiCTlhUh9nAQawskNdPZYaLfySjCFn/lY0ZzDI jRgz3pCl44ZE5a/gjGDBTDyMbpSugF6oVWwVJlNlLdft6/84nfc7yCNWXob81quUPL8I KYyQ== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=gV1e6AW4; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id r23si15908811pgu.359.2018.11.11.16.09.43; Sun, 11 Nov 2018 16:09:58 -0800 (PST) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=gV1e6AW4; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1731097AbeKLIR3 (ORCPT + 99 others); Mon, 12 Nov 2018 03:17:29 -0500 Received: from mail.kernel.org ([198.145.29.99]:59904 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1730931AbeKLIR1 (ORCPT ); Mon, 12 Nov 2018 03:17:27 -0500 Received: from localhost (unknown [206.108.79.134]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 346B421731; Sun, 11 Nov 2018 22:27:32 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1541975252; bh=QXuQfDEYOXlKelbRiKbM+wcq4I72RYoJtKVHmeeiolg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=gV1e6AW4IGDcJpncSg2UUerWtybZZxQ3fGTDDr3HPx0SPsrezuqvGHGdyO4ip7ajI ZV3SCkpSDHiVQlXZqc37uTb8mpEReIOJ1Vga1u1T3bfLJxFCszy/hotqnqz8BiAxeK RUFgWkXupUIuXfJzh4Wkn1k4G57cQefABYttEcw0= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Siva Rebbagondla , Kalle Valo , Sasha Levin Subject: [PATCH 4.19 119/361] rsi: fix memory alignment issue in ARM32 platforms Date: Sun, 11 Nov 2018 14:17:46 -0800 Message-Id: <20181111221636.701875521@linuxfoundation.org> X-Mailer: git-send-email 2.19.1 In-Reply-To: <20181111221619.915519183@linuxfoundation.org> References: <20181111221619.915519183@linuxfoundation.org> User-Agent: quilt/0.65 X-stable: review MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org 4.19-stable review patch. If anyone has any objections, please let me know. ------------------ From: Siva Rebbagondla [ Upstream commit baa8caf4ab7af2d9e84b566b99fe919a4e9e7562 ] During testing in ARM32 platforms, observed below kernel panic, as driver accessing data beyond the allocated memory while submitting URB to USB. Fix: Resolved this by specifying correct length by considering 64 bit alignment. so that, USB bus driver will access only allocated memory. Unit-test: Tested and confirm that driver bring up and scanning, connection and data transfer works fine with this fix. ...skipping... [ 25.389450] Unable to handle kernel paging request at virtual address 5aa11422 [ 25.403078] Internal error: Oops: 5 [#1] SMP ARM [ 25.407703] Modules linked in: rsi_usb [ 25.411473] CPU: 1 PID: 317 Comm: RX-Thread Not tainted 4.18.0-rc7 #1 [ 25.419221] Hardware name: Freescale i.MX6 Quad/DualLite (Device Tree) [ 25.425764] PC is at skb_release_data+0x90/0x168 [ 25.430393] LR is at skb_release_all+0x28/0x2c [ 25.434842] pc : [<807435b0>] lr : [<80742ba0>] psr: 200e0013 5aa1141e [ 25.464633] Flags: nzCv IRQs on FIQs on Mode SVC_32 ISA ARM Segment none [ 25.477524] Process RX-Thread (pid: 317, stack limit = 0x(ptrval)) [ 25.483709] Stack: (0xedf69ed8 to 0xedf6a000) [ 25.569907] Backtrace: [ 25.572368] [<80743520>] (skb_release_data) from [<80742ba0>] (skb_release_all+0x28/0x2c) [ 25.580555] r9:7f00258c r8:00000001 r7:ee355000 r6:eddab0d0 r5:eddab000 r4:eddbb840 [ 25.588308] [<80742b78>] (skb_release_all) from [<807432cc>] (consume_skb+0x30/0x50) [ 25.596055] r5:eddab000 r4:eddbb840 [ 25.599648] [<8074329c>] (consume_skb) from [<7f00117c>] (rsi_usb_rx_thread+0x64/0x12c [rsi_usb]) [ 25.608524] r5:eddab000 r4:eddbb840 [ 25.612116] [<7f001118>] (rsi_usb_rx_thread [rsi_usb]) from [<80142750>] (kthread+0x11c/0x15c) [ 25.620735] r10:ee9ff9e0 r9:edcde3b8 r8:ee355000 r7:edf68000 r6:edd3a780 r5:00000000 [ 25.628567] r4:edcde380 [ 25.631110] [<80142634>] (kthread) from [<801010e8>] (ret_from_fork+0x14/0x2c) [ 25.638336] Exception stack(0xedf69fb0 to 0xedf69ff8) [ 25.682929] ---[ end trace 8236a5496f5b5d3b ]--- Signed-off-by: Siva Rebbagondla Signed-off-by: Kalle Valo Signed-off-by: Sasha Levin Signed-off-by: Greg Kroah-Hartman --- drivers/net/wireless/rsi/rsi_91x_usb.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) --- a/drivers/net/wireless/rsi/rsi_91x_usb.c +++ b/drivers/net/wireless/rsi/rsi_91x_usb.c @@ -266,15 +266,17 @@ static void rsi_rx_done_handler(struct u if (urb->status) goto out; - if (urb->actual_length <= 0) { - rsi_dbg(INFO_ZONE, "%s: Zero length packet\n", __func__); + if (urb->actual_length <= 0 || + urb->actual_length > rx_cb->rx_skb->len) { + rsi_dbg(INFO_ZONE, "%s: Invalid packet length = %d\n", + __func__, urb->actual_length); goto out; } if (skb_queue_len(&dev->rx_q) >= RSI_MAX_RX_PKTS) { rsi_dbg(INFO_ZONE, "Max RX packets reached\n"); goto out; } - skb_put(rx_cb->rx_skb, urb->actual_length); + skb_trim(rx_cb->rx_skb, urb->actual_length); skb_queue_tail(&dev->rx_q, rx_cb->rx_skb); rsi_set_event(&dev->rx_thread.event); @@ -308,6 +310,7 @@ static int rsi_rx_urb_submit(struct rsi_ if (!skb) return -ENOMEM; skb_reserve(skb, MAX_DWORD_ALIGN_BYTES); + skb_put(skb, RSI_MAX_RX_USB_PKT_SIZE - MAX_DWORD_ALIGN_BYTES); dword_align_bytes = (unsigned long)skb->data & 0x3f; if (dword_align_bytes > 0) skb_push(skb, dword_align_bytes); @@ -319,7 +322,7 @@ static int rsi_rx_urb_submit(struct rsi_ usb_rcvbulkpipe(dev->usbdev, dev->bulkin_endpoint_addr[ep_num - 1]), urb->transfer_buffer, - RSI_MAX_RX_USB_PKT_SIZE, + skb->len, rsi_rx_done_handler, rx_cb);