linux-kernel - [71/90] p54usb: Remove DMA buffer from stack

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Wed, 16 Dec 2009 17:15:22 -0800
From:	Greg KH <gregkh@...e.de>
To:	linux-kernel@...r.kernel.org, stable@...nel.org
Cc:	stable-review@...nel.org, torvalds@...ux-foundation.org,
	akpm@...ux-foundation.org, alan@...rguk.ukuu.org.uk,
	Larry Finger <Larry.Finger@...inger.net>,
	"John W. Linville" <linville@...driver.com>
Subject: [71/90] p54usb: Remove DMA buffer from stack

2.6.31-stable review patch.  If anyone has any objections, please let us know.

------------------

From: Larry Finger <Larry.Finger@...inger.net>

commit 21d6c270f11c7d0ab5aafa48a6e79ba514f4e5e7 upstream.

On 2.6.32-rc6 from wireless-testing, the following warning is emitted:

------------[ cut here ]------------
WARNING: at lib/dma-debug.c:860 check_for_stack+0xaa/0xe0()
Hardware name: HP Pavilion dv2700 Notebook PC
ehci_hcd 0000:00:02.1: DMA-API: device driver maps memory fromstack
	 [addr=ffff8800b6e2bca8]
Modules linked in: <Removed>
Pid: 16378, comm: modprobe Not tainted 2.6.32-rc6-wl #244
Call Trace:
 [<ffffffff81049698>] warn_slowpath_common+0x78/0xb0
 [<ffffffff8104972c>] warn_slowpath_fmt+0x3c/0x40
 [<ffffffff811ae52a>] check_for_stack+0xaa/0xe0
 [<ffffffff811afc8d>] debug_dma_map_page+0xfd/0x170
 [<ffffffffa006297a>] usb_hcd_submit_urb+0x3da/0x9c0 [usbcore]
 [<ffffffff81076e6f>] ? lockdep_init_map+0x5f/0x5d0
 [<ffffffffa0063365>] usb_submit_urb+0xe5/0x260 [usbcore]
 [<ffffffffa0064b7e>] usb_start_wait_urb+0x5e/0xf0 [usbcore]
 [<ffffffffa0063943>] ? usb_init_urb+0x23/0x40 [usbcore]
 [<ffffffffa0064cd4>] usb_bulk_msg+0xc4/0x150 [usbcore]
 [<ffffffffa0441a91>] T.719+0x31/0x40 [p54usb]
 [<ffffffffa0441acf>] p54u_upload_firmware_3887+0x2f/0x490 [p54usb]
 [<ffffffffa049c667>] ? p54_parse_firmware+0x427/0x450 [p54common]
 <Rest of traceback removed>
---[ end trace f77df0316ddad3de ]---

Signed-off-by: Larry Finger <Larry.Finger@...inger.net>
Signed-off-by: John W. Linville <linville@...driver.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@...e.de>

---
 drivers/net/wireless/p54/p54usb.c |   10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

--- a/drivers/net/wireless/p54/p54usb.c
+++ b/drivers/net/wireless/p54/p54usb.c
@@ -427,12 +427,16 @@ static const char p54u_romboot_3887[] = 
 static int p54u_firmware_reset_3887(struct ieee80211_hw *dev)
 {
 	struct p54u_priv *priv = dev->priv;
-	u8 buf[4];
+	u8 *buf;
 	int ret;
 
-	memcpy(&buf, p54u_romboot_3887, sizeof(buf));
+	buf = kmalloc(4, GFP_KERNEL);
+	if (!buf)
+		return -ENOMEM;
+	memcpy(buf, p54u_romboot_3887, 4);
 	ret = p54u_bulk_msg(priv, P54U_PIPE_DATA,
-			    buf, sizeof(buf));
+			    buf, 4);
+	kfree(buf);
 	if (ret)
 		dev_err(&priv->udev->dev, "(p54usb) unable to jump to "
 			"boot ROM (%d)!\n", ret);


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/