From: Greg Kroah-Hartman Date: Mon, 11 Jul 2022 06:39:40 +0000 (+0200) Subject: 4.19-stable patches X-Git-Tag: v4.9.323~18 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=1d258144c8f3b7b358afca075bfd093ac29a5477;p=thirdparty%2Fkernel%2Fstable-queue.git 4.19-stable patches added patches: misc-rtsx_usb-fix-use-of-dma-mapped-buffer-for-usb-bulk-transfer.patch misc-rtsx_usb-set-return-value-in-rsp_buf-alloc-err-path.patch misc-rtsx_usb-use-separate-command-and-response-buffers.patch --- diff --git a/queue-4.19/misc-rtsx_usb-fix-use-of-dma-mapped-buffer-for-usb-bulk-transfer.patch b/queue-4.19/misc-rtsx_usb-fix-use-of-dma-mapped-buffer-for-usb-bulk-transfer.patch new file mode 100644 index 00000000000..8478bbcac25 --- /dev/null +++ b/queue-4.19/misc-rtsx_usb-fix-use-of-dma-mapped-buffer-for-usb-bulk-transfer.patch @@ -0,0 +1,86 @@ +From eb7f8e28420372787933eec079735c35034bda7d Mon Sep 17 00:00:00 2001 +From: Shuah Khan +Date: Thu, 30 Jun 2022 20:32:55 -0600 +Subject: misc: rtsx_usb: fix use of dma mapped buffer for usb bulk transfer + +From: Shuah Khan + +commit eb7f8e28420372787933eec079735c35034bda7d upstream. + +rtsx_usb driver allocates coherent dma buffer for urb transfers. +This buffer is passed to usb_bulk_msg() and usb core tries to +map already mapped buffer running into a dma mapping error. + +xhci_hcd 0000:01:00.0: rejecting DMA map of vmalloc memory +WARNING: CPU: 1 PID: 279 at include/linux/dma-mapping.h:326 usb_ hcd_map_urb_for_dma+0x7d6/0x820 + +... + +xhci_map_urb_for_dma+0x291/0x4e0 +usb_hcd_submit_urb+0x199/0x12b0 +... +usb_submit_urb+0x3b8/0x9e0 +usb_start_wait_urb+0xe3/0x2d0 +usb_bulk_msg+0x115/0x240 +rtsx_usb_transfer_data+0x185/0x1a8 [rtsx_usb] +rtsx_usb_send_cmd+0xbb/0x123 [rtsx_usb] +rtsx_usb_write_register+0x12c/0x143 [rtsx_usb] +rtsx_usb_probe+0x226/0x4b2 [rtsx_usb] + +Fix it to use kmalloc() to get DMA-able memory region instead. + +Signed-off-by: Shuah Khan +Cc: stable +Link: https://lore.kernel.org/r/667d627d502e1ba9ff4f9b94966df3299d2d3c0d.1656642167.git.skhan@linuxfoundation.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/misc/cardreader/rtsx_usb.c | 13 +++++++------ + include/linux/rtsx_usb.h | 1 - + 2 files changed, 7 insertions(+), 7 deletions(-) + +--- a/drivers/misc/cardreader/rtsx_usb.c ++++ b/drivers/misc/cardreader/rtsx_usb.c +@@ -642,8 +642,7 @@ static int rtsx_usb_probe(struct usb_int + + ucr->pusb_dev = usb_dev; + +- ucr->iobuf = usb_alloc_coherent(ucr->pusb_dev, IOBUF_SIZE, +- GFP_KERNEL, &ucr->iobuf_dma); ++ ucr->iobuf = kmalloc(IOBUF_SIZE, GFP_KERNEL); + if (!ucr->iobuf) + return -ENOMEM; + +@@ -679,8 +678,9 @@ static int rtsx_usb_probe(struct usb_int + + out_init_fail: + usb_set_intfdata(ucr->pusb_intf, NULL); +- usb_free_coherent(ucr->pusb_dev, IOBUF_SIZE, ucr->iobuf, +- ucr->iobuf_dma); ++ kfree(ucr->iobuf); ++ ucr->iobuf = NULL; ++ ucr->cmd_buf = ucr->rsp_buf = NULL; + return ret; + } + +@@ -693,8 +693,9 @@ static void rtsx_usb_disconnect(struct u + mfd_remove_devices(&intf->dev); + + usb_set_intfdata(ucr->pusb_intf, NULL); +- usb_free_coherent(ucr->pusb_dev, IOBUF_SIZE, ucr->iobuf, +- ucr->iobuf_dma); ++ kfree(ucr->iobuf); ++ ucr->iobuf = NULL; ++ ucr->cmd_buf = ucr->rsp_buf = NULL; + } + + #ifdef CONFIG_PM +--- a/include/linux/rtsx_usb.h ++++ b/include/linux/rtsx_usb.h +@@ -66,7 +66,6 @@ struct rtsx_ucr { + struct usb_interface *pusb_intf; + struct usb_sg_request current_sg; + unsigned char *iobuf; +- dma_addr_t iobuf_dma; + + struct timer_list sg_timer; + struct mutex dev_mutex; diff --git a/queue-4.19/misc-rtsx_usb-set-return-value-in-rsp_buf-alloc-err-path.patch b/queue-4.19/misc-rtsx_usb-set-return-value-in-rsp_buf-alloc-err-path.patch new file mode 100644 index 00000000000..32d117da5ce --- /dev/null +++ b/queue-4.19/misc-rtsx_usb-set-return-value-in-rsp_buf-alloc-err-path.patch @@ -0,0 +1,50 @@ +From 2cd37c2e72449a7add6da1183d20a6247d6db111 Mon Sep 17 00:00:00 2001 +From: Shuah Khan +Date: Fri, 1 Jul 2022 10:53:52 -0600 +Subject: misc: rtsx_usb: set return value in rsp_buf alloc err path + +From: Shuah Khan + +commit 2cd37c2e72449a7add6da1183d20a6247d6db111 upstream. + +Set return value in rsp_buf alloc error path before going to +error handling. + +drivers/misc/cardreader/rtsx_usb.c:639:6: warning: variable 'ret' is used uninitialized whenever 'if' condition is true [-Wsometimes-uninitialized] + if (!ucr->rsp_buf) + ^~~~~~~~~~~~~ + drivers/misc/cardreader/rtsx_usb.c:678:9: note: uninitialized use occurs here + return ret; + ^~~ + drivers/misc/cardreader/rtsx_usb.c:639:2: note: remove the 'if' if its condition is always false + if (!ucr->rsp_buf) + ^~~~~~~~~~~~~~~~~~ + drivers/misc/cardreader/rtsx_usb.c:622:9: note: initialize the variable 'ret' to silence this warning + int ret; + ^ + = 0 + +Fixes: 3776c7855985 ("misc: rtsx_usb: use separate command and response buffers") +Reported-by: kernel test robot +Cc: stable +Signed-off-by: Shuah Khan +Link: https://lore.kernel.org/r/20220701165352.15687-1-skhan@linuxfoundation.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/misc/cardreader/rtsx_usb.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/misc/cardreader/rtsx_usb.c ++++ b/drivers/misc/cardreader/rtsx_usb.c +@@ -647,8 +647,10 @@ static int rtsx_usb_probe(struct usb_int + return -ENOMEM; + + ucr->rsp_buf = kmalloc(IOBUF_SIZE, GFP_KERNEL); +- if (!ucr->rsp_buf) ++ if (!ucr->rsp_buf) { ++ ret = -ENOMEM; + goto out_free_cmd_buf; ++ } + + usb_set_intfdata(intf, ucr); + diff --git a/queue-4.19/misc-rtsx_usb-use-separate-command-and-response-buffers.patch b/queue-4.19/misc-rtsx_usb-use-separate-command-and-response-buffers.patch new file mode 100644 index 00000000000..982f2d1782a --- /dev/null +++ b/queue-4.19/misc-rtsx_usb-use-separate-command-and-response-buffers.patch @@ -0,0 +1,89 @@ +From 3776c78559853fd151be7c41e369fd076fb679d5 Mon Sep 17 00:00:00 2001 +From: Shuah Khan +Date: Thu, 30 Jun 2022 20:32:56 -0600 +Subject: misc: rtsx_usb: use separate command and response buffers + +From: Shuah Khan + +commit 3776c78559853fd151be7c41e369fd076fb679d5 upstream. + +rtsx_usb uses same buffer for command and response. There could +be a potential conflict using the same buffer for both especially +if retries and timeouts are involved. + +Use separate command and response buffers to avoid conflicts. + +Signed-off-by: Shuah Khan +Cc: stable +Link: https://lore.kernel.org/r/07e3721804ff07aaab9ef5b39a5691d0718b9ade.1656642167.git.skhan@linuxfoundation.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/misc/cardreader/rtsx_usb.c | 26 +++++++++++++++++--------- + include/linux/rtsx_usb.h | 1 - + 2 files changed, 17 insertions(+), 10 deletions(-) + +--- a/drivers/misc/cardreader/rtsx_usb.c ++++ b/drivers/misc/cardreader/rtsx_usb.c +@@ -642,15 +642,18 @@ static int rtsx_usb_probe(struct usb_int + + ucr->pusb_dev = usb_dev; + +- ucr->iobuf = kmalloc(IOBUF_SIZE, GFP_KERNEL); +- if (!ucr->iobuf) ++ ucr->cmd_buf = kmalloc(IOBUF_SIZE, GFP_KERNEL); ++ if (!ucr->cmd_buf) + return -ENOMEM; + ++ ucr->rsp_buf = kmalloc(IOBUF_SIZE, GFP_KERNEL); ++ if (!ucr->rsp_buf) ++ goto out_free_cmd_buf; ++ + usb_set_intfdata(intf, ucr); + + ucr->vendor_id = id->idVendor; + ucr->product_id = id->idProduct; +- ucr->cmd_buf = ucr->rsp_buf = ucr->iobuf; + + mutex_init(&ucr->dev_mutex); + +@@ -678,9 +681,11 @@ static int rtsx_usb_probe(struct usb_int + + out_init_fail: + usb_set_intfdata(ucr->pusb_intf, NULL); +- kfree(ucr->iobuf); +- ucr->iobuf = NULL; +- ucr->cmd_buf = ucr->rsp_buf = NULL; ++ kfree(ucr->rsp_buf); ++ ucr->rsp_buf = NULL; ++out_free_cmd_buf: ++ kfree(ucr->cmd_buf); ++ ucr->cmd_buf = NULL; + return ret; + } + +@@ -693,9 +698,12 @@ static void rtsx_usb_disconnect(struct u + mfd_remove_devices(&intf->dev); + + usb_set_intfdata(ucr->pusb_intf, NULL); +- kfree(ucr->iobuf); +- ucr->iobuf = NULL; +- ucr->cmd_buf = ucr->rsp_buf = NULL; ++ ++ kfree(ucr->cmd_buf); ++ ucr->cmd_buf = NULL; ++ ++ kfree(ucr->rsp_buf); ++ ucr->rsp_buf = NULL; + } + + #ifdef CONFIG_PM +--- a/include/linux/rtsx_usb.h ++++ b/include/linux/rtsx_usb.h +@@ -65,7 +65,6 @@ struct rtsx_ucr { + struct usb_device *pusb_dev; + struct usb_interface *pusb_intf; + struct usb_sg_request current_sg; +- unsigned char *iobuf; + + struct timer_list sg_timer; + struct mutex dev_mutex; diff --git a/queue-4.19/series b/queue-4.19/series index e0ec996d0d7..bb0531f9603 100644 --- a/queue-4.19/series +++ b/queue-4.19/series @@ -21,3 +21,6 @@ selftests-forwarding-fix-flood_unicast_test-when-h2-.patch selftests-forwarding-fix-learning_test-when-h1-suppo.patch selftests-forwarding-fix-error-message-in-learning_t.patch i2c-cadence-unregister-the-clk-notifier-in-error-pat.patch +misc-rtsx_usb-fix-use-of-dma-mapped-buffer-for-usb-bulk-transfer.patch +misc-rtsx_usb-use-separate-command-and-response-buffers.patch +misc-rtsx_usb-set-return-value-in-rsp_buf-alloc-err-path.patch