From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, raymond pang <raymondpangxd@gmail.com>,
Jens Axboe <axboe@kernel.dk>,
"Sasha Levin (Microsoft)" <sashal@kernel.org>
Subject: [PATCH 4.9 28/32] libata: fix using DMA buffers on stack
Date: Thu, 2 May 2019 17:21:14 +0200 [thread overview]
Message-ID: <20190502143322.591277926@linuxfoundation.org> (raw)
In-Reply-To: <20190502143314.649935114@linuxfoundation.org>
[ Upstream commit dd08a8d9a66de4b54575c294a92630299f7e0fe7 ]
When CONFIG_VMAP_STACK=y, __pa() returns incorrect physical address for
a stack virtual address. Stack DMA buffers must be avoided.
Signed-off-by: raymond pang <raymondpangxd@gmail.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin (Microsoft) <sashal@kernel.org>
---
drivers/ata/libata-zpodd.c | 34 ++++++++++++++++++++++++----------
1 file changed, 24 insertions(+), 10 deletions(-)
diff --git a/drivers/ata/libata-zpodd.c b/drivers/ata/libata-zpodd.c
index 0ad96c647541..7017a81d53cf 100644
--- a/drivers/ata/libata-zpodd.c
+++ b/drivers/ata/libata-zpodd.c
@@ -51,38 +51,52 @@ static int eject_tray(struct ata_device *dev)
/* Per the spec, only slot type and drawer type ODD can be supported */
static enum odd_mech_type zpodd_get_mech_type(struct ata_device *dev)
{
- char buf[16];
+ char *buf;
unsigned int ret;
- struct rm_feature_desc *desc = (void *)(buf + 8);
+ struct rm_feature_desc *desc;
struct ata_taskfile tf;
static const char cdb[] = { GPCMD_GET_CONFIGURATION,
2, /* only 1 feature descriptor requested */
0, 3, /* 3, removable medium feature */
0, 0, 0,/* reserved */
- 0, sizeof(buf),
+ 0, 16,
0, 0, 0,
};
+ buf = kzalloc(16, GFP_KERNEL);
+ if (!buf)
+ return ODD_MECH_TYPE_UNSUPPORTED;
+ desc = (void *)(buf + 8);
+
ata_tf_init(dev, &tf);
tf.flags = ATA_TFLAG_ISADDR | ATA_TFLAG_DEVICE;
tf.command = ATA_CMD_PACKET;
tf.protocol = ATAPI_PROT_PIO;
- tf.lbam = sizeof(buf);
+ tf.lbam = 16;
ret = ata_exec_internal(dev, &tf, cdb, DMA_FROM_DEVICE,
- buf, sizeof(buf), 0);
- if (ret)
+ buf, 16, 0);
+ if (ret) {
+ kfree(buf);
return ODD_MECH_TYPE_UNSUPPORTED;
+ }
- if (be16_to_cpu(desc->feature_code) != 3)
+ if (be16_to_cpu(desc->feature_code) != 3) {
+ kfree(buf);
return ODD_MECH_TYPE_UNSUPPORTED;
+ }
- if (desc->mech_type == 0 && desc->load == 0 && desc->eject == 1)
+ if (desc->mech_type == 0 && desc->load == 0 && desc->eject == 1) {
+ kfree(buf);
return ODD_MECH_TYPE_SLOT;
- else if (desc->mech_type == 1 && desc->load == 0 && desc->eject == 1)
+ } else if (desc->mech_type == 1 && desc->load == 0 &&
+ desc->eject == 1) {
+ kfree(buf);
return ODD_MECH_TYPE_DRAWER;
- else
+ } else {
+ kfree(buf);
return ODD_MECH_TYPE_UNSUPPORTED;
+ }
}
/* Test if ODD is zero power ready by sense code */
--
2.19.1
next prev parent reply other threads:[~2019-05-02 15:22 UTC|newest]
Thread overview: 38+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-05-02 15:20 [PATCH 4.9 00/32] 4.9.173-stable review Greg Kroah-Hartman
2019-05-02 15:20 ` [PATCH 4.9 01/32] usbnet: ipheth: prevent TX queue timeouts when device not ready Greg Kroah-Hartman
2019-05-02 15:20 ` [PATCH 4.9 02/32] usbnet: ipheth: fix potential null pointer dereference in ipheth_carrier_set Greg Kroah-Hartman
2019-05-02 15:20 ` [PATCH 4.9 03/32] media: vivid: check if the cec_adapter is valid Greg Kroah-Hartman
2019-05-02 15:20 ` [PATCH 4.9 04/32] ARM: dts: bcm283x: Fix hdmi hpd gpio pull Greg Kroah-Hartman
2019-05-02 15:20 ` [PATCH 4.9 05/32] s390: limit brk randomization to 32MB Greg Kroah-Hartman
2019-05-02 15:20 ` [PATCH 4.9 06/32] qlcnic: Avoid potential NULL pointer dereference Greg Kroah-Hartman
2019-05-02 15:20 ` [PATCH 4.9 07/32] netfilter: nft_set_rbtree: check for inactive element after flag mismatch Greg Kroah-Hartman
2019-05-02 15:20 ` [PATCH 4.9 08/32] netfilter: bridge: set skb transport_header before entering NF_INET_PRE_ROUTING Greg Kroah-Hartman
2019-05-02 15:20 ` [PATCH 4.9 09/32] sc16is7xx: missing unregister/delete driver on error in sc16is7xx_init() Greg Kroah-Hartman
2019-05-02 15:20 ` [PATCH 4.9 10/32] serial: ar933x_uart: Fix build failure with disabled console Greg Kroah-Hartman
2019-05-02 15:20 ` [PATCH 4.9 11/32] usb: gadget: net2280: Fix overrun of OUT messages Greg Kroah-Hartman
2019-05-02 15:20 ` [PATCH 4.9 12/32] usb: gadget: net2280: Fix net2280_dequeue() Greg Kroah-Hartman
2019-05-02 15:20 ` [PATCH 4.9 13/32] usb: gadget: net2272: Fix net2272_dequeue() Greg Kroah-Hartman
2019-05-02 15:21 ` [PATCH 4.9 14/32] ARM: dts: pfla02: increase phy reset duration Greg Kroah-Hartman
2019-05-02 15:21 ` [PATCH 4.9 15/32] net: ks8851: Dequeue RX packets explicitly Greg Kroah-Hartman
2019-05-02 15:21 ` [PATCH 4.9 16/32] net: ks8851: Reassert reset pin if chip ID check fails Greg Kroah-Hartman
2019-05-02 15:21 ` [PATCH 4.9 17/32] net: ks8851: Delay requesting IRQ until opened Greg Kroah-Hartman
2019-05-02 15:21 ` [PATCH 4.9 18/32] net: ks8851: Set initial carrier state to down Greg Kroah-Hartman
2019-05-02 15:21 ` [PATCH 4.9 19/32] staging: rtl8712: uninitialized memory in read_bbreg_hdl() Greg Kroah-Hartman
2019-05-02 15:21 ` [PATCH 4.9 20/32] NFS: Fix a typo in nfs_init_timeout_values() Greg Kroah-Hartman
2019-05-02 15:21 ` [PATCH 4.9 21/32] net: xilinx: fix possible object reference leak Greg Kroah-Hartman
2019-05-02 15:21 ` [PATCH 4.9 22/32] net: ibm: " Greg Kroah-Hartman
2019-05-02 15:21 ` [PATCH 4.9 23/32] net: ethernet: ti: " Greg Kroah-Hartman
2019-05-02 15:21 ` [PATCH 4.9 24/32] scsi: qla4xxx: fix a potential NULL pointer dereference Greg Kroah-Hartman
2019-05-02 15:21 ` [PATCH 4.9 25/32] usb: u132-hcd: fix resource leak Greg Kroah-Hartman
2019-05-02 15:21 ` [PATCH 4.9 26/32] ceph: fix use-after-free on symlink traversal Greg Kroah-Hartman
2019-05-02 15:21 ` [PATCH 4.9 27/32] scsi: zfcp: reduce flood of fcrscn1 trace records on multi-element RSCN Greg Kroah-Hartman
2019-05-02 15:21 ` Greg Kroah-Hartman [this message]
2019-05-02 15:21 ` [PATCH 4.9 29/32] gpio: of: Fix of_gpiochip_add() error path Greg Kroah-Hartman
2019-05-02 15:21 ` [PATCH 4.9 30/32] kconfig/[mn]conf: handle backspace (^H) key Greg Kroah-Hartman
2019-05-02 15:21 ` [PATCH 4.9 31/32] leds: pca9532: fix a potential NULL pointer dereference Greg Kroah-Hartman
2019-05-02 15:21 ` [PATCH 4.9 32/32] vfio/type1: Limit DMA mappings per container Greg Kroah-Hartman
2019-05-02 23:06 ` [PATCH 4.9 00/32] 4.9.173-stable review kernelci.org bot
2019-05-03 7:04 ` Naresh Kamboju
2019-05-03 9:27 ` Jon Hunter
2019-05-03 17:15 ` Guenter Roeck
2019-05-03 21:21 ` shuah
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20190502143322.591277926@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=axboe@kernel.dk \
--cc=linux-kernel@vger.kernel.org \
--cc=raymondpangxd@gmail.com \
--cc=sashal@kernel.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).