linux-kernel - [PATCH] BugFix in XHCI controller driver for scatter gather DMA

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:	Wed, 23 Dec 2015 17:28:28 +0530
From:	Vikas Bansal <vikas.bansal@...sung.com>
To:	mathias.nyman@...el.com, gregkh@...uxfoundation.org,
	linux-usb@...r.kernel.org, linux-kernel@...r.kernel.org
Cc:	sumit.batra@...sung.com, Vikas Bansal <vikas.bansal@...sung.com>
Subject: [PATCH] BugFix in XHCI controller driver for scatter gather DMA

From: Sumit Batra <sumit.batra@...sung.com> 

Pre-Condition 
URB with Scatter Gather list is queued to bulk OUT endpoint.
Every buffer in scatter gather list is not a multiple of maximum packet 
size for that endpoint(short packet).
CHAIN bit is set for all TRBs in a TD so that the DMA happens to all of 
them at once. 

Issue
DMA operation copies all the CHAINED TRBs at contiguous device memory.
But since the original packet was a short packet, so the actual data is 
re-aligned after this DMA operation.
At device end this re-aligned data causes data integrity issue with 
applications like ICMP ping.

Solution
Don't set the CHAINED bit for these TRBs, if their buffers are not a 
multiple of maximum packet size.
This will reduce the benefit in throughput as required from a scatter 
gather implementation, but this reduces the CPU utilization.
And solves the data integrity issue on Device End

Signed-off-by: Sumit Batra <sumit.batra@...sung.com>
Signed-off-by: Vikas Bansal <vikas.bansal@...sung.com>
diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
index 7d34cbf..7363dee 100644
--- a/drivers/usb/host/xhci-ring.c
+++ b/drivers/usb/host/xhci-ring.c
@@ -3110,7 +3110,9 @@ static int queue_bulk_sg_tx(struct xhci_hcd *xhci, gfp_t mem_flags,
 		 * TRB to indicate it's the last TRB in the chain.
 		 */
 		if (num_trbs > 1) {
-			field |= TRB_CHAIN;
+			if (this_sg_len %
+					usb_endpoint_maxp(&urb->ep->desc) == 0)
+				field |= TRB_CHAIN;
 		} else {
 			/* FIXME - add check for ZERO_PACKET flag before this */
 			td->last_trb = ep_ring->enqueue;
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/