Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.36 as permitted sender) client-ip=23.128.96.36;
Date:   Wed, 11 Oct 2023 23:51:58 +0200
From:   Thierry Reding <thierry.reding@gmail.com>
To:     =?utf-8?B?TWljaGHFgiBNaXJvc8WCYXc=?= <mirq-linux@rere.qmqm.pl>
Cc:     Peter Chen <peter.chen@kernel.org>,
        Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
        Peter Geis <pgwipeout@gmail.com>,
        Thierry Reding <treding@nvidia.com>,
        Dmitry Osipenko <digetx@gmail.com>, linux-usb@vger.kernel.org,
        linux-kernel@vger.kernel.org, linux-tegra@vger.kernel.org
Subject: Re: [PATCH v2 1/3] usb: chipidea: Fix DMA overwrite for Tegra
Message-ID: <ZScY_uXsxamjnfPC@orome.fritz.box>
References: <cover.1695934946.git.mirq-linux@rere.qmqm.pl>
 <ef8466b834c1726f5404c95c3e192e90460146f8.1695934946.git.mirq-linux@rere.qmqm.pl>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha256;
        protocol="application/pgp-signature"; boundary="sglXe+Dqwf9Z+IJZ"
Content-Disposition: inline
In-Reply-To: <ef8466b834c1726f5404c95c3e192e90460146f8.1695934946.git.mirq-linux@rere.qmqm.pl>
User-Agent: Mutt/2.2.12 (2023-09-09)
Precedence: bulk


--sglXe+Dqwf9Z+IJZ
Content-Type: text/plain; charset=utf-8
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Thu, Sep 28, 2023 at 11:06:03PM +0200, Micha=C5=82 Miros=C5=82aw wrote:
> Tegra USB controllers seem to issue DMA in full 32-bit words only and thus
> may overwrite unevenly-sized buffers.  One such occurrence is detected by
> SLUB when receiving a reply to a 1-byte buffer (below).  Fix this by
> allocating a bounce buffer also for buffers with sizes not a multiple of =
4.
>=20
> =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D
> BUG kmalloc-64 (Tainted: G    B             ): kmalloc Redzone overwritten
> -------------------------------------------------------------------------=
----
>=20
> 0x8555cd02-0x8555cd03 @offset=3D3330. First byte 0x0 instead of 0xcc
> Allocated in usb_get_status+0x2b/0xac age=3D1 cpu=3D3 pid=3D41
>  __kmem_cache_alloc_node+0x12f/0x1e4
>  __kmalloc+0x33/0x8c
>  usb_get_status+0x2b/0xac
>  hub_probe+0x5e9/0xcec
>  usb_probe_interface+0xbf/0x21c
>  really_probe+0xa5/0x2c4
>  __driver_probe_device+0x75/0x174
>  driver_probe_device+0x31/0x94
>  __device_attach_driver+0x65/0xc0
>  bus_for_each_drv+0x4b/0x74
>  __device_attach+0x69/0x120
>  bus_probe_device+0x65/0x6c
>  device_add+0x48b/0x5f8
>  usb_set_configuration+0x37b/0x6b4
>  usb_generic_driver_probe+0x37/0x68
>  usb_probe_device+0x35/0xb4
> Slab 0xbf622b80 objects=3D21 used=3D18 fp=3D0x8555cdc0 flags=3D0x800(slab=
|zone=3D0)
> Object 0x8555cd00 @offset=3D3328 fp=3D0x00000000
>=20
> Redzone  8555ccc0: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc  .....=
=2E..........
> Redzone  8555ccd0: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc  .....=
=2E..........
> Redzone  8555cce0: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc  .....=
=2E..........
> Redzone  8555ccf0: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc  .....=
=2E..........
> Object   8555cd00: 01 00 00 00 cc cc cc cc cc cc cc cc cc cc cc cc  .....=
=2E..........
> Object   8555cd10: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc  .....=
=2E..........
> Object   8555cd20: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc  .....=
=2E..........
> Object   8555cd30: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc  .....=
=2E..........
> Redzone  8555cd40: cc cc cc cc                                      ....
> Padding  8555cd74: 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a              ZZZZZ=
ZZZZZZZ
> CPU: 3 PID: 41 Comm: kworker/3:1 Tainted: G    B              6.6.0-rc1mq=
-00118-g59786f827ea1 #1115
> Hardware name: NVIDIA Tegra SoC (Flattened Device Tree)
> Workqueue: usb_hub_wq hub_event
> [<8010ca28>] (unwind_backtrace) from [<801090a5>] (show_stack+0x11/0x14)
> [<801090a5>] (show_stack) from [<805da2fb>] (dump_stack_lvl+0x4d/0x7c)
> [<805da2fb>] (dump_stack_lvl) from [<8026464f>] (check_bytes_and_report+0=
xb3/0xe4)
> [<8026464f>] (check_bytes_and_report) from [<802648e1>] (check_object+0x2=
61/0x290)
> [<802648e1>] (check_object) from [<802671b1>] (free_to_partial_list+0x105=
/0x3f8)
> [<802671b1>] (free_to_partial_list) from [<80268613>] (__kmem_cache_free+=
0x103/0x128)
> [<80268613>] (__kmem_cache_free) from [<80425a67>] (usb_get_status+0x73/0=
xac)
> [<80425a67>] (usb_get_status) from [<80421b31>] (hub_probe+0x5e9/0xcec)
> [<80421b31>] (hub_probe) from [<80428bbb>] (usb_probe_interface+0xbf/0x21=
c)
> [<80428bbb>] (usb_probe_interface) from [<803ee13d>] (really_probe+0xa5/0=
x2c4)
> [<803ee13d>] (really_probe) from [<803ee3d1>] (__driver_probe_device+0x75=
/0x174)
> [<803ee3d1>] (__driver_probe_device) from [<803ee501>] (driver_probe_devi=
ce+0x31/0x94)
> usb 1-1: device descriptor read/8, error -71
>=20
> Fixes: fc53d5279094 ("usb: chipidea: tegra: Support host mode")
> Signed-off-by: Micha=C5=82 Miros=C5=82aw <mirq-linux@rere.qmqm.pl>
> ---
>  drivers/usb/chipidea/host.c | 7 ++++---
>  1 file changed, 4 insertions(+), 3 deletions(-)

Acked-by: Thierry Reding <treding@nvidia.com>

--sglXe+Dqwf9Z+IJZ
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQIzBAABCAAdFiEEiOrDCAFJzPfAjcif3SOs138+s6EFAmUnGPsACgkQ3SOs138+
s6GYow//R+s/b6fhumEI29E9pNwezoNjdeR5ahN/rQjsuIIn+tvrXNqWlBJLKMsi
S3EJoX4Pu4imyiQeMaaqnPRFrS4nIH7TybPo3HU5OucvQd1Gm6GaPPfZrGTu2eBr
UsCyEYa6jDoYZ5LX9wCW/HXFAYqTBFQ4kzZ0BD0uiaBK7+0I7hw1wpvwKV9BxJnq
q6AbB3cR0zJ0hJxiaDay0ucuDUNBfeepxFaS/R5hLA2xMNT7r4PR5/OIWduwEcki
LzEG5gE68lmeGDcggHN7SQBtVnjCeVP1fx1P6lj0u8EBuoGvnNA1tKMwPZz2tOdV
QPYJvlQCFS79K+MxwKwsFJMfPLeeOogsR2W3ck3qLGV4uqBsB3gBSk0u9jBQWMYN
+w2E76xiBgizpGsqeai2lzh0ue0nCbfq6DvvHuJRtxM8FPRyH211DcRml2momKAD
PNNkp/j8PSs+lKncw3Wxxn4gFzwjvZLAPHY39sRVQalwwtSO19vFzwgB42EJF9iL
Cf9jFeopUYzZsXRqpnkfgCtiES/JHcHsddf5SA/uLRCJJ2u6e4pHjVAnQj7B9qKo
B2PvhtoDhXfDY4xHGurprHMfIKDVnso/sYfmVMzZRMfC35oRG0ManiqU4cg2PZtB
XllVU7SBcN7gNxwK/toSgbZLdoHiXG4Bn9e2fegjPaqBQjrmZmc=
=oFX6
-----END PGP SIGNATURE-----

--sglXe+Dqwf9Z+IJZ--