Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 45681366 authored by Florian Fainelli's avatar Florian Fainelli Committed by Greg Kroah-Hartman
Browse files

usb: core: Check URB setup_packet and transfer_buffer sanity 



Update usb_hcd_map_urb_for_dma() to check for an URB's setup_packet and
transfer_buffer sanity. We first check that urb->setup_packet is neither
coming from vmalloc space nor is an on stack buffer, and if that's the
case, produce a warning and return an error. For urb->transfer_buffer
there is an existing is_vmalloc_addr() check so we just supplement that
with an object_is_on_stack() check, produce a warning if that is the case
and also return an error.

Signed-off-by: default avatarFlorian Fainelli <f.fainelli@gmail.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 64b9533e

drivers/usb/core/hcd.c

+12 −0
Original line number Diff line number Diff line
@@ -26,6 +26,7 @@ 
#include <linux/module.h>

#include <linux/version.h>

#include <linux/kernel.h>

#include <linux/sched/task_stack.h>

#include <linux/slab.h>

#include <linux/completion.h>

#include <linux/utsname.h>
@@ -1523,6 +1524,14 @@ int usb_hcd_map_urb_for_dma(struct usb_hcd *hcd, struct urb *urb, 
		if (hcd->self.uses_pio_for_control)

			return ret;

		if (IS_ENABLED(CONFIG_HAS_DMA) && hcd->self.uses_dma) {

			if (is_vmalloc_addr(urb->setup_packet)) {

				WARN_ONCE(1, "setup packet is not dma capable\n");

				return -EAGAIN;

			} else if (object_is_on_stack(urb->setup_packet)) {

				WARN_ONCE(1, "setup packet is on stack\n");

				return -EAGAIN;

			}



			urb->setup_dma = dma_map_single(

					hcd->self.sysdev,

					urb->setup_packet,
@@ -1587,6 +1596,9 @@ int usb_hcd_map_urb_for_dma(struct usb_hcd *hcd, struct urb *urb, 
			} else if (is_vmalloc_addr(urb->transfer_buffer)) {

				WARN_ONCE(1, "transfer buffer not dma capable\n");

				ret = -EAGAIN;

			} else if (object_is_on_stack(urb->transfer_buffer)) {

				WARN_ONCE(1, "transfer buffer is on stack\n");

				ret = -EAGAIN;

			} else {

				urb->transfer_dma = dma_map_single(

						hcd->self.sysdev,