* [PATCH 0/1] xhci fix for usb-linus 5.11-final
@ 2021-02-03 11:37 Mathias Nyman
2021-02-03 11:37 ` [PATCH 1/1] xhci: fix bounce buffer usage for non-sg list case Mathias Nyman
2021-02-03 12:24 ` [PATCH 0/1] xhci fix for usb-linus 5.11-final Greg KH
0 siblings, 2 replies; 3+ messages in thread
From: Mathias Nyman @ 2021-02-03 11:37 UTC (permalink / raw)
To: gregkh; +Cc: linux-usb, Mathias Nyman
Hi Greg
One last xhci fix for 5.11-final if it still can make it.
Thanks
-Mathias
Mathias Nyman (1):
xhci: fix bounce buffer usage for non-sg list case
drivers/usb/host/xhci-ring.c | 31 ++++++++++++++++++++-----------
1 file changed, 20 insertions(+), 11 deletions(-)
--
2.25.1
^ permalink raw reply [flat|nested] 3+ messages in thread
* [PATCH 1/1] xhci: fix bounce buffer usage for non-sg list case
2021-02-03 11:37 [PATCH 0/1] xhci fix for usb-linus 5.11-final Mathias Nyman
@ 2021-02-03 11:37 ` Mathias Nyman
2021-02-03 12:24 ` [PATCH 0/1] xhci fix for usb-linus 5.11-final Greg KH
1 sibling, 0 replies; 3+ messages in thread
From: Mathias Nyman @ 2021-02-03 11:37 UTC (permalink / raw)
To: gregkh; +Cc: linux-usb, Mathias Nyman, stable, Andreas Hartmann
xhci driver may in some special cases need to copy small amounts
of payload data to a bounce buffer in order to meet the boundary
and alignment restrictions set by the xHCI specification.
In the majority of these cases the data is in a sg list, and
driver incorrectly assumed data is always in urb->sg when using
the bounce buffer.
If data instead is contiguous, and in urb->transfer_buffer, we may still
need to bounce buffer a small part if data starts very close (less than
packet size) to a 64k boundary.
Check if sg list is used before copying data to/from it.
Fixes: f9c589e142d0 ("xhci: TD-fragment, align the unsplittable case with a bounce buffer")
Cc: stable@vger.kernel.org
Reported-by: Andreas Hartmann <andihartmann@01019freenet.de>
Tested-by: Andreas Hartmann <andihartmann@01019freenet.de>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
---
drivers/usb/host/xhci-ring.c | 31 ++++++++++++++++++++-----------
1 file changed, 20 insertions(+), 11 deletions(-)
diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
index cf0c93a90200..89c3be9917f6 100644
--- a/drivers/usb/host/xhci-ring.c
+++ b/drivers/usb/host/xhci-ring.c
@@ -699,11 +699,16 @@ static void xhci_unmap_td_bounce_buffer(struct xhci_hcd *xhci,
dma_unmap_single(dev, seg->bounce_dma, ring->bounce_buf_len,
DMA_FROM_DEVICE);
/* for in tranfers we need to copy the data from bounce to sg */
- len = sg_pcopy_from_buffer(urb->sg, urb->num_sgs, seg->bounce_buf,
- seg->bounce_len, seg->bounce_offs);
- if (len != seg->bounce_len)
- xhci_warn(xhci, "WARN Wrong bounce buffer read length: %zu != %d\n",
- len, seg->bounce_len);
+ if (urb->num_sgs) {
+ len = sg_pcopy_from_buffer(urb->sg, urb->num_sgs, seg->bounce_buf,
+ seg->bounce_len, seg->bounce_offs);
+ if (len != seg->bounce_len)
+ xhci_warn(xhci, "WARN Wrong bounce buffer read length: %zu != %d\n",
+ len, seg->bounce_len);
+ } else {
+ memcpy(urb->transfer_buffer + seg->bounce_offs, seg->bounce_buf,
+ seg->bounce_len);
+ }
seg->bounce_len = 0;
seg->bounce_offs = 0;
}
@@ -3277,12 +3282,16 @@ static int xhci_align_td(struct xhci_hcd *xhci, struct urb *urb, u32 enqd_len,
/* create a max max_pkt sized bounce buffer pointed to by last trb */
if (usb_urb_dir_out(urb)) {
- len = sg_pcopy_to_buffer(urb->sg, urb->num_sgs,
- seg->bounce_buf, new_buff_len, enqd_len);
- if (len != new_buff_len)
- xhci_warn(xhci,
- "WARN Wrong bounce buffer write length: %zu != %d\n",
- len, new_buff_len);
+ if (urb->num_sgs) {
+ len = sg_pcopy_to_buffer(urb->sg, urb->num_sgs,
+ seg->bounce_buf, new_buff_len, enqd_len);
+ if (len != new_buff_len)
+ xhci_warn(xhci, "WARN Wrong bounce buffer write length: %zu != %d\n",
+ len, new_buff_len);
+ } else {
+ memcpy(seg->bounce_buf, urb->transfer_buffer + enqd_len, new_buff_len);
+ }
+
seg->bounce_dma = dma_map_single(dev, seg->bounce_buf,
max_pkt, DMA_TO_DEVICE);
} else {
--
2.25.1
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH 0/1] xhci fix for usb-linus 5.11-final
2021-02-03 11:37 [PATCH 0/1] xhci fix for usb-linus 5.11-final Mathias Nyman
2021-02-03 11:37 ` [PATCH 1/1] xhci: fix bounce buffer usage for non-sg list case Mathias Nyman
@ 2021-02-03 12:24 ` Greg KH
1 sibling, 0 replies; 3+ messages in thread
From: Greg KH @ 2021-02-03 12:24 UTC (permalink / raw)
To: Mathias Nyman; +Cc: linux-usb
On Wed, Feb 03, 2021 at 01:37:01PM +0200, Mathias Nyman wrote:
> Hi Greg
>
> One last xhci fix for 5.11-final if it still can make it.
Now snuck in!
thanks,
greg k-h
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2021-02-03 12:25 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-02-03 11:37 [PATCH 0/1] xhci fix for usb-linus 5.11-final Mathias Nyman
2021-02-03 11:37 ` [PATCH 1/1] xhci: fix bounce buffer usage for non-sg list case Mathias Nyman
2021-02-03 12:24 ` [PATCH 0/1] xhci fix for usb-linus 5.11-final Greg KH
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).