--- /dev/null
+From eb7f8e28420372787933eec079735c35034bda7d Mon Sep 17 00:00:00 2001
+From: Shuah Khan <skhan@linuxfoundation.org>
+Date: Thu, 30 Jun 2022 20:32:55 -0600
+Subject: misc: rtsx_usb: fix use of dma mapped buffer for usb bulk transfer
+
+From: Shuah Khan <skhan@linuxfoundation.org>
+
+commit eb7f8e28420372787933eec079735c35034bda7d upstream.
+
+rtsx_usb driver allocates coherent dma buffer for urb transfers.
+This buffer is passed to usb_bulk_msg() and usb core tries to
+map already mapped buffer running into a dma mapping error.
+
+xhci_hcd 0000:01:00.0: rejecting DMA map of vmalloc memory
+WARNING: CPU: 1 PID: 279 at include/linux/dma-mapping.h:326 usb_ hcd_map_urb_for_dma+0x7d6/0x820
+
+...
+
+xhci_map_urb_for_dma+0x291/0x4e0
+usb_hcd_submit_urb+0x199/0x12b0
+...
+usb_submit_urb+0x3b8/0x9e0
+usb_start_wait_urb+0xe3/0x2d0
+usb_bulk_msg+0x115/0x240
+rtsx_usb_transfer_data+0x185/0x1a8 [rtsx_usb]
+rtsx_usb_send_cmd+0xbb/0x123 [rtsx_usb]
+rtsx_usb_write_register+0x12c/0x143 [rtsx_usb]
+rtsx_usb_probe+0x226/0x4b2 [rtsx_usb]
+
+Fix it to use kmalloc() to get DMA-able memory region instead.
+
+Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
+Cc: stable <stable@kernel.org>
+Link: https://lore.kernel.org/r/667d627d502e1ba9ff4f9b94966df3299d2d3c0d.1656642167.git.skhan@linuxfoundation.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/misc/cardreader/rtsx_usb.c | 13 +++++++------
+ include/linux/rtsx_usb.h | 1 -
+ 2 files changed, 7 insertions(+), 7 deletions(-)
+
+--- a/drivers/misc/cardreader/rtsx_usb.c
++++ b/drivers/misc/cardreader/rtsx_usb.c
+@@ -642,8 +642,7 @@ static int rtsx_usb_probe(struct usb_int
+
+ ucr->pusb_dev = usb_dev;
+
+- ucr->iobuf = usb_alloc_coherent(ucr->pusb_dev, IOBUF_SIZE,
+- GFP_KERNEL, &ucr->iobuf_dma);
++ ucr->iobuf = kmalloc(IOBUF_SIZE, GFP_KERNEL);
+ if (!ucr->iobuf)
+ return -ENOMEM;
+
+@@ -679,8 +678,9 @@ static int rtsx_usb_probe(struct usb_int
+
+ out_init_fail:
+ usb_set_intfdata(ucr->pusb_intf, NULL);
+- usb_free_coherent(ucr->pusb_dev, IOBUF_SIZE, ucr->iobuf,
+- ucr->iobuf_dma);
++ kfree(ucr->iobuf);
++ ucr->iobuf = NULL;
++ ucr->cmd_buf = ucr->rsp_buf = NULL;
+ return ret;
+ }
+
+@@ -693,8 +693,9 @@ static void rtsx_usb_disconnect(struct u
+ mfd_remove_devices(&intf->dev);
+
+ usb_set_intfdata(ucr->pusb_intf, NULL);
+- usb_free_coherent(ucr->pusb_dev, IOBUF_SIZE, ucr->iobuf,
+- ucr->iobuf_dma);
++ kfree(ucr->iobuf);
++ ucr->iobuf = NULL;
++ ucr->cmd_buf = ucr->rsp_buf = NULL;
+ }
+
+ #ifdef CONFIG_PM
+--- a/include/linux/rtsx_usb.h
++++ b/include/linux/rtsx_usb.h
+@@ -66,7 +66,6 @@ struct rtsx_ucr {
+ struct usb_interface *pusb_intf;
+ struct usb_sg_request current_sg;
+ unsigned char *iobuf;
+- dma_addr_t iobuf_dma;
+
+ struct timer_list sg_timer;
+ struct mutex dev_mutex;
--- /dev/null
+From 2cd37c2e72449a7add6da1183d20a6247d6db111 Mon Sep 17 00:00:00 2001
+From: Shuah Khan <skhan@linuxfoundation.org>
+Date: Fri, 1 Jul 2022 10:53:52 -0600
+Subject: misc: rtsx_usb: set return value in rsp_buf alloc err path
+
+From: Shuah Khan <skhan@linuxfoundation.org>
+
+commit 2cd37c2e72449a7add6da1183d20a6247d6db111 upstream.
+
+Set return value in rsp_buf alloc error path before going to
+error handling.
+
+drivers/misc/cardreader/rtsx_usb.c:639:6: warning: variable 'ret' is used uninitialized whenever 'if' condition is true [-Wsometimes-uninitialized]
+ if (!ucr->rsp_buf)
+ ^~~~~~~~~~~~~
+ drivers/misc/cardreader/rtsx_usb.c:678:9: note: uninitialized use occurs here
+ return ret;
+ ^~~
+ drivers/misc/cardreader/rtsx_usb.c:639:2: note: remove the 'if' if its condition is always false
+ if (!ucr->rsp_buf)
+ ^~~~~~~~~~~~~~~~~~
+ drivers/misc/cardreader/rtsx_usb.c:622:9: note: initialize the variable 'ret' to silence this warning
+ int ret;
+ ^
+ = 0
+
+Fixes: 3776c7855985 ("misc: rtsx_usb: use separate command and response buffers")
+Reported-by: kernel test robot <lkp@intel.com>
+Cc: stable <stable@kernel.org>
+Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
+Link: https://lore.kernel.org/r/20220701165352.15687-1-skhan@linuxfoundation.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/misc/cardreader/rtsx_usb.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/misc/cardreader/rtsx_usb.c
++++ b/drivers/misc/cardreader/rtsx_usb.c
+@@ -647,8 +647,10 @@ static int rtsx_usb_probe(struct usb_int
+ return -ENOMEM;
+
+ ucr->rsp_buf = kmalloc(IOBUF_SIZE, GFP_KERNEL);
+- if (!ucr->rsp_buf)
++ if (!ucr->rsp_buf) {
++ ret = -ENOMEM;
+ goto out_free_cmd_buf;
++ }
+
+ usb_set_intfdata(intf, ucr);
+
--- /dev/null
+From 3776c78559853fd151be7c41e369fd076fb679d5 Mon Sep 17 00:00:00 2001
+From: Shuah Khan <skhan@linuxfoundation.org>
+Date: Thu, 30 Jun 2022 20:32:56 -0600
+Subject: misc: rtsx_usb: use separate command and response buffers
+
+From: Shuah Khan <skhan@linuxfoundation.org>
+
+commit 3776c78559853fd151be7c41e369fd076fb679d5 upstream.
+
+rtsx_usb uses same buffer for command and response. There could
+be a potential conflict using the same buffer for both especially
+if retries and timeouts are involved.
+
+Use separate command and response buffers to avoid conflicts.
+
+Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
+Cc: stable <stable@kernel.org>
+Link: https://lore.kernel.org/r/07e3721804ff07aaab9ef5b39a5691d0718b9ade.1656642167.git.skhan@linuxfoundation.org
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/misc/cardreader/rtsx_usb.c | 26 +++++++++++++++++---------
+ include/linux/rtsx_usb.h | 1 -
+ 2 files changed, 17 insertions(+), 10 deletions(-)
+
+--- a/drivers/misc/cardreader/rtsx_usb.c
++++ b/drivers/misc/cardreader/rtsx_usb.c
+@@ -642,15 +642,18 @@ static int rtsx_usb_probe(struct usb_int
+
+ ucr->pusb_dev = usb_dev;
+
+- ucr->iobuf = kmalloc(IOBUF_SIZE, GFP_KERNEL);
+- if (!ucr->iobuf)
++ ucr->cmd_buf = kmalloc(IOBUF_SIZE, GFP_KERNEL);
++ if (!ucr->cmd_buf)
+ return -ENOMEM;
+
++ ucr->rsp_buf = kmalloc(IOBUF_SIZE, GFP_KERNEL);
++ if (!ucr->rsp_buf)
++ goto out_free_cmd_buf;
++
+ usb_set_intfdata(intf, ucr);
+
+ ucr->vendor_id = id->idVendor;
+ ucr->product_id = id->idProduct;
+- ucr->cmd_buf = ucr->rsp_buf = ucr->iobuf;
+
+ mutex_init(&ucr->dev_mutex);
+
+@@ -678,9 +681,11 @@ static int rtsx_usb_probe(struct usb_int
+
+ out_init_fail:
+ usb_set_intfdata(ucr->pusb_intf, NULL);
+- kfree(ucr->iobuf);
+- ucr->iobuf = NULL;
+- ucr->cmd_buf = ucr->rsp_buf = NULL;
++ kfree(ucr->rsp_buf);
++ ucr->rsp_buf = NULL;
++out_free_cmd_buf:
++ kfree(ucr->cmd_buf);
++ ucr->cmd_buf = NULL;
+ return ret;
+ }
+
+@@ -693,9 +698,12 @@ static void rtsx_usb_disconnect(struct u
+ mfd_remove_devices(&intf->dev);
+
+ usb_set_intfdata(ucr->pusb_intf, NULL);
+- kfree(ucr->iobuf);
+- ucr->iobuf = NULL;
+- ucr->cmd_buf = ucr->rsp_buf = NULL;
++
++ kfree(ucr->cmd_buf);
++ ucr->cmd_buf = NULL;
++
++ kfree(ucr->rsp_buf);
++ ucr->rsp_buf = NULL;
+ }
+
+ #ifdef CONFIG_PM
+--- a/include/linux/rtsx_usb.h
++++ b/include/linux/rtsx_usb.h
+@@ -65,7 +65,6 @@ struct rtsx_ucr {
+ struct usb_device *pusb_dev;
+ struct usb_interface *pusb_intf;
+ struct usb_sg_request current_sg;
+- unsigned char *iobuf;
+
+ struct timer_list sg_timer;
+ struct mutex dev_mutex;
selftests-forwarding-fix-learning_test-when-h1-suppo.patch
selftests-forwarding-fix-error-message-in-learning_t.patch
i2c-cadence-unregister-the-clk-notifier-in-error-pat.patch
+misc-rtsx_usb-fix-use-of-dma-mapped-buffer-for-usb-bulk-transfer.patch
+misc-rtsx_usb-use-separate-command-and-response-buffers.patch
+misc-rtsx_usb-set-return-value-in-rsp_buf-alloc-err-path.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
