linux-kernel - [PATCH] USB: OHCI: ohci-sm501: complete URBs in BH context

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Fri,  3 Aug 2018 21:01:19 -0700
From:   Guenter Roeck <linux@...ck-us.net>
To:     Alan Stern <stern@...land.harvard.edu>
Cc:     Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        linux-usb@...r.kernel.org, linux-kernel@...r.kernel.org,
        Guenter Roeck <linux@...ck-us.net>
Subject: [PATCH] USB: OHCI: ohci-sm501: complete URBs in BH context

Testing an USB drive connected to ohci-sm501 results in a large number
of runtime warnings.

WARNING: CPU: 0 PID: 0 at ./include/linux/dma-mapping.h:541
hcd_buffer_free+0x148/0x178
Modules linked in:

CPU: 0 PID: 0 Comm: swapper Not tainted 4.18.0-rc7-00014-g7ec386e4c991-dirty
PC is at hcd_buffer_free+0x148/0x178
PR is at hcd_buffer_free+0x66/0x178
PC  : 8c26cbb0 SP  : 8c481da8 SR  : 400080f1
TEA : c00c8fe0
R0  : 000000f0 R1  : 000000f0 R2  : 8f9bb890 R3  : 00000000
R4  : 8f9c8800 R5  : 00001004 R6  : b07c6000 R7  : 007c6000
R8  : 00001004 R9  : 8f9bb814 R10 : 8c388104 R11 : 007c6000
R12 : b07c6000 R13 : 8f875680 R14 : 00000000
MACH: 000002fe MACL: 0000017c GBR : 00000000 PR  : 8c26cace

Call trace:
 [<(ptrval)>] usb_hcd_unmap_urb_for_dma+0xf4/0x13c
 [<(ptrval)>] arch_local_save_flags+0x0/0x8
 [<(ptrval)>] __usb_hcd_giveback_urb+0x2e/0xdc
 [<(ptrval)>] arch_local_save_flags+0x0/0x8
 [<(ptrval)>] finish_urb+0x8a/0x164
 [<(ptrval)>] arch_local_save_flags+0x0/0x8
 [<(ptrval)>] printk+0x0/0x48
 [<(ptrval)>] ohci_work.part.11+0x150/0x41c
 [<(ptrval)>] td_done.isra.4+0x0/0x11c
 [<(ptrval)>] vprintk_default+0x14/0x20
 [<(ptrval)>] arch_local_save_flags+0x0/0x8
 [<(ptrval)>] ohci_irq+0x20c/0x314
 [<(ptrval)>] usb_hcd_irq+0x16/0x28

Code analysis shows that interrupts are indeed disabled in ohci_irq().
Handle the situation by setting the HCD_BH flag in the ohci-sm501 driver.
With this flag set, urbs are released in a tasklet and not by the
interrupt handler.

Fixes: f54aab6ebcecd ("usb: ohci-sm501 driver")
Signed-off-by: Guenter Roeck <linux@...ck-us.net>
---
 drivers/usb/host/ohci-sm501.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/usb/host/ohci-sm501.c b/drivers/usb/host/ohci-sm501.c
index c9233cddf9a2..eeb5b3137cf2 100644
--- a/drivers/usb/host/ohci-sm501.c
+++ b/drivers/usb/host/ohci-sm501.c
@@ -49,7 +49,7 @@ static const struct hc_driver ohci_sm501_hc_driver = {
 	 * generic hardware linkage
 	 */
 	.irq =			ohci_irq,
-	.flags =		HCD_USB11 | HCD_MEMORY | HCD_LOCAL_MEM,
+	.flags =		HCD_USB11 | HCD_MEMORY | HCD_LOCAL_MEM | HCD_BH,
 
 	/*
 	 * basic lifecycle operations
-- 
2.7.4