linux-kernel - [PATCH] dvb-usb-firmware: use DMA buffers for USB transfers

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <b23506f9-96a8-aedb-919a-edc34a2e11cb@message-id.googlemail.com>
Date:   Sat, 18 Feb 2017 23:18:51 +0100
From:   Stefan Seyfried <stefan.seyfried@...glemail.com>
To:     Mauro Carvalho Chehab <mchehab@...pensource.com>
Cc:     LKML <linux-kernel@...r.kernel.org>
Subject: [PATCH] dvb-usb-firmware: use DMA buffers for USB transfers

From: Stefan Seyfried <seife+kernel@...systems.com>

The USB control messages require DMA to work. We cannot pass
a stack-allocated buffer, as it is not warranted that the
stack would be into a DMA enabled area.

Signed-off-by: Stefan Seyfried <seife+kernel@...systems.com>
---

This fixes at least dvb-usb-technisat-usb2 for me, but probably
the other drivers that are using dvb_usb_download_firmware()
with a Cypress chip are broken with CONFIG_VMAP_STACK=y right
now. Patch attached additionally, because I don't think
thunderbird will get this right :-(

 drivers/media/usb/dvb-usb/dvb-usb-firmware.c | 28 ++++++++++++++++------------
 1 file changed, 16 insertions(+), 12 deletions(-)

diff --git a/drivers/media/usb/dvb-usb/dvb-usb-firmware.c b/drivers/media/usb/dvb-usb/dvb-usb-firmware.c
index f0023dbb7276..2f340621a786 100644
--- a/drivers/media/usb/dvb-usb/dvb-usb-firmware.c
+++ b/drivers/media/usb/dvb-usb/dvb-usb-firmware.c
@@ -35,41 +35,45 @@ static int usb_cypress_writemem(struct usb_device *udev,u16 addr,u8 *data, u8 le
 
 int usb_cypress_load_firmware(struct usb_device *udev, const struct firmware *fw, int type)
 {
-	struct hexline hx;
-	u8 reset;
 	int ret,pos=0;
+	/* urb buffers must be malloc'ed, stack will not work with CONFIG_VMAP_STACK=y */
+	u8 *reset = kmalloc(1, GFP_KERNEL);
+	struct hexline *hx = kmalloc(sizeof(struct hexline), GFP_KERNEL);
 
 	/* stop the CPU */
-	reset = 1;
-	if ((ret = usb_cypress_writemem(udev,cypress[type].cpu_cs_register,&reset,1)) != 1)
+	*reset = 1;
+	if ((ret = usb_cypress_writemem(udev,cypress[type].cpu_cs_register,reset,1)) != 1)
 		err("could not stop the USB controller CPU.");
 
-	while ((ret = dvb_usb_get_hexline(fw,&hx,&pos)) > 0) {
-		deb_fw("writing to address 0x%04x (buffer: 0x%02x %02x)\n",hx.addr,hx.len,hx.chk);
-		ret = usb_cypress_writemem(udev,hx.addr,hx.data,hx.len);
+	while ((ret = dvb_usb_get_hexline(fw,hx,&pos)) > 0) {
+		deb_fw("writing to address 0x%04x (buffer: 0x%02x %02x)\n",hx->addr,hx->len,hx->chk);
+		ret = usb_cypress_writemem(udev,hx->addr,hx->data,hx->len);
 
-		if (ret != hx.len) {
+		if (ret != hx->len) {
 			err("error while transferring firmware (transferred size: %d, block size: %d)",
-				ret,hx.len);
+				ret,hx->len);
 			ret = -EINVAL;
 			break;
 		}
 	}
 	if (ret < 0) {
 		err("firmware download failed at %d with %d",pos,ret);
-		return ret;
+		goto out_free;
 	}
 
 	if (ret == 0) {
 		/* restart the CPU */
-		reset = 0;
-		if (ret || usb_cypress_writemem(udev,cypress[type].cpu_cs_register,&reset,1) != 1) {
+		*reset = 0;
+		if (ret || usb_cypress_writemem(udev,cypress[type].cpu_cs_register,reset,1) != 1) {
 			err("could not restart the USB controller CPU.");
 			ret = -EINVAL;
 		}
 	} else
 		ret = -EIO;
 
+ out_free:
+	kfree(reset);
+	kfree(hx);
 	return ret;
 }
 EXPORT_SYMBOL(usb_cypress_load_firmware);
-- 
Stefan Seyfried

"For a successful technology, reality must take precedence over
 public relations, for nature cannot be fooled." -- Richard Feynman

View attachment "0001-dvb-usb-firmware-use-DMA-buffers-for-USB-transfers.patch" of type "text/x-patch" (2748 bytes)