linux-kernel - Re: [PATCH 2/2] usb: host: Fix excessive alignment restriction for local memory allocations

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20190625205445.GB7449@roeck-us.net>
Date:   Tue, 25 Jun 2019 13:54:45 -0700
From:   Guenter Roeck <linux@...ck-us.net>
To:     Fredrik Noring <noring@...rew.org>
Cc:     Christoph Hellwig <hch@....de>, laurentiu.tudor@....com,
        stern@...land.harvard.edu, gregkh@...uxfoundation.org,
        linux-usb@...r.kernel.org, marex@...x.de, leoyang.li@....com,
        linux-kernel@...r.kernel.org, robin.murphy@....com,
        JuergenUrban@....de
Subject: Re: [PATCH 2/2] usb: host: Fix excessive alignment restriction for
 local memory allocations

On Tue, Jun 25, 2019 at 05:08:23PM +0200, Fredrik Noring wrote:
> The PAGE_SHIFT alignment restriction to devm_gen_pool_create() quickly
> exhaust local memory because most allocations are much smaller than
> PAGE_SIZE. This causes USB device failures such as
> 
> 	usb 1-2.1: reset full-speed USB device number 4 using sm501-usb
> 	sd 1:0:0:0: [sda] tag#0 UNKNOWN(0x2003) Result: hostbyte=0x03 driverbyte=0x00
> 	sd 1:0:0:0: [sda] tag#0 CDB: opcode=0x28 28 00 00 00 08 7c 00 00 f0 00
> 	print_req_error: I/O error, dev sda, sector 2172 flags 80700
> 
> when trying to boot from the SM501 USB controller on SH4 with QEMU.
> 
> Align allocations as required but not necessarily much more than that.
> The HCCA, TD and ED structures align with 256, 32 and 16 byte memory
> boundaries, as specified by the Open HCI[1]. The min_alloc_order argument
> to devm_gen_pool_create is now somewhat arbitrarily set to 4 (16 bytes).
> Perhaps it could be somewhat lower for general buffer allocations.
> 
> Reference:
> 
> [1] "Open Host Controller Interface Specification for USB",
>     release 1.0a, Compaq, Microsoft, National Semiconductor, 1999,
>     pp. 16, 19, 33.
> 
> Reported-by: Guenter Roeck <linux@...ck-us.net>
> Signed-off-by: Fredrik Noring <noring@...rew.org>

Tested-by: Guenter Roeck <linux@...ck-us.net>

> ---
>  drivers/usb/core/hcd.c      | 2 +-
>  drivers/usb/host/ohci-hcd.c | 4 ++--
>  drivers/usb/host/ohci-mem.c | 6 ++++--
>  3 files changed, 7 insertions(+), 5 deletions(-)
> 
> diff --git a/drivers/usb/core/hcd.c b/drivers/usb/core/hcd.c
> index b2362303d32f..48483fa71854 100644
> --- a/drivers/usb/core/hcd.c
> +++ b/drivers/usb/core/hcd.c
> @@ -3014,7 +3014,7 @@ int usb_hcd_setup_local_mem(struct usb_hcd *hcd, phys_addr_t phys_addr,
>  	int err;
>  	void __iomem *local_mem;
>  
> -	hcd->localmem_pool = devm_gen_pool_create(hcd->self.sysdev, PAGE_SHIFT,
> +	hcd->localmem_pool = devm_gen_pool_create(hcd->self.sysdev, 4,
>  						  dev_to_node(hcd->self.sysdev),
>  						  dev_name(hcd->self.sysdev));
>  	if (IS_ERR(hcd->localmem_pool))
> diff --git a/drivers/usb/host/ohci-hcd.c b/drivers/usb/host/ohci-hcd.c
> index 5801858d867e..b457fdaff297 100644
> --- a/drivers/usb/host/ohci-hcd.c
> +++ b/drivers/usb/host/ohci-hcd.c
> @@ -507,9 +507,9 @@ static int ohci_init (struct ohci_hcd *ohci)
>  	ohci->prev_frame_no = IO_WATCHDOG_OFF;
>  
>  	if (hcd->localmem_pool)
> -		ohci->hcca = gen_pool_dma_alloc(hcd->localmem_pool,
> +		ohci->hcca = gen_pool_dma_alloc_align(hcd->localmem_pool,
>  						sizeof(*ohci->hcca),
> -						&ohci->hcca_dma);
> +						&ohci->hcca_dma, 256);
>  	else
>  		ohci->hcca = dma_alloc_coherent(hcd->self.controller,
>  						sizeof(*ohci->hcca),
> diff --git a/drivers/usb/host/ohci-mem.c b/drivers/usb/host/ohci-mem.c
> index 4afe27cc7e46..1425335c6baf 100644
> --- a/drivers/usb/host/ohci-mem.c
> +++ b/drivers/usb/host/ohci-mem.c
> @@ -94,7 +94,8 @@ td_alloc (struct ohci_hcd *hc, gfp_t mem_flags)
>  	struct usb_hcd	*hcd = ohci_to_hcd(hc);
>  
>  	if (hcd->localmem_pool)
> -		td = gen_pool_dma_zalloc(hcd->localmem_pool, sizeof(*td), &dma);
> +		td = gen_pool_dma_zalloc_align(hcd->localmem_pool,
> +				sizeof(*td), &dma, 32);
>  	else
>  		td = dma_pool_zalloc(hc->td_cache, mem_flags, &dma);
>  	if (td) {
> @@ -137,7 +138,8 @@ ed_alloc (struct ohci_hcd *hc, gfp_t mem_flags)
>  	struct usb_hcd	*hcd = ohci_to_hcd(hc);
>  
>  	if (hcd->localmem_pool)
> -		ed = gen_pool_dma_zalloc(hcd->localmem_pool, sizeof(*ed), &dma);
> +		ed = gen_pool_dma_zalloc_align(hcd->localmem_pool,
> +				sizeof(*ed), &dma, 16);
>  	else
>  		ed = dma_pool_zalloc(hc->ed_cache, mem_flags, &dma);
>  	if (ed) {
> -- 
> 2.21.0
>