linux-kernel - cdc_ncm uses stack memory for DMA

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20110801195949.GB2096@zod.bos.redhat.com>
Date:	Mon, 1 Aug 2011 15:59:50 -0400
From:	Josh Boyer <jwboyer@...hat.com>
To:	Oliver Neukum <oliver@...kum.name>
Cc:	Greg Kroah-Hartman <gregkh@...e.de>, linux-usb@...r.kernel.org,
	linux-kernel@...r.kernel.org
Subject: cdc_ncm uses stack memory for DMA

Hi,

We've gotten a report that the cdc_ncm driver generates a stacktrace due
to using stack variables that are passed to cdc_ncm_do_request.  You can
find the stack trace here:

https://bugzilla.redhat.com/show_bug.cgi?id=720128

It's generated by lib/dma-debug.c and we have CONFIG_DMA_API_DEBUG set
in our development kernels.

Looking through the code, it seems that cdc_ncm_setup is still passing
stack variables around lines 270, 276, 375, and 406.  Which of those
exactly is triggering the backtrace, I'm not sure but all of them seem
incorrect from what I can tell.

Do you have any thoughts on a solution for this?  Off the top of my
head, either the local variables being used could be added to the ctx
structure or the variables can be changed to pointers and then be
allocated via kmalloc and torn down shortly after.

josh
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/