* [PATCH v2 0/3] usb: chipidea: An USB DMA fix + cleanups for Tegra
@ 2023-09-28 21:06 Michał Mirosław
2023-09-28 21:06 ` [PATCH v2 1/3] usb: chipidea: Fix DMA overwrite " Michał Mirosław
` (2 more replies)
0 siblings, 3 replies; 10+ messages in thread
From: Michał Mirosław @ 2023-09-28 21:06 UTC (permalink / raw)
To: Dmitry Osipenko, Greg Kroah-Hartman, Peter Chen, Peter Geis,
Thierry Reding
Cc: linux-kernel, linux-tegra, linux-usb
This series contains a fix for a DMA buffer overflow in Tegra USB driver
followed by a cleanup of the DMA bounce buffer code and another cleanup
to make probe() consistently use dev_err_probe() for error printk()s.
v2: reworded the commit message in patch #1
Michał Mirosław (3):
usb: chipidea: Fix DMA overwrite for Tegra
usb: chipidea: Simplify Tegra DMA alignment code
usb: chipidea: tegra: Consistently use dev_err_probe()
drivers/usb/chipidea/ci_hdrc_tegra.c | 16 ++++------
drivers/usb/chipidea/host.c | 48 ++++++++++++----------------
2 files changed, 27 insertions(+), 37 deletions(-)
--
2.39.2
^ permalink raw reply [flat|nested] 10+ messages in thread
* [PATCH v2 1/3] usb: chipidea: Fix DMA overwrite for Tegra
2023-09-28 21:06 [PATCH v2 0/3] usb: chipidea: An USB DMA fix + cleanups for Tegra Michał Mirosław
@ 2023-09-28 21:06 ` Michał Mirosław
2023-10-11 21:51 ` Thierry Reding
2023-10-12 14:28 ` Peter Chen
2023-09-28 21:06 ` [PATCH v2 2/3] usb: chipidea: Simplify Tegra DMA alignment code Michał Mirosław
2023-09-28 21:06 ` [PATCH v2 3/3] usb: chipidea: tegra: Consistently use dev_err_probe() Michał Mirosław
2 siblings, 2 replies; 10+ messages in thread
From: Michał Mirosław @ 2023-09-28 21:06 UTC (permalink / raw)
To: Peter Chen, Greg Kroah-Hartman, Peter Geis, Thierry Reding,
Dmitry Osipenko
Cc: linux-usb, linux-kernel, linux-tegra
Tegra USB controllers seem to issue DMA in full 32-bit words only and thus
may overwrite unevenly-sized buffers. One such occurrence is detected by
SLUB when receiving a reply to a 1-byte buffer (below). Fix this by
allocating a bounce buffer also for buffers with sizes not a multiple of 4.
=============================================================================
BUG kmalloc-64 (Tainted: G B ): kmalloc Redzone overwritten
-----------------------------------------------------------------------------
0x8555cd02-0x8555cd03 @offset=3330. First byte 0x0 instead of 0xcc
Allocated in usb_get_status+0x2b/0xac age=1 cpu=3 pid=41
__kmem_cache_alloc_node+0x12f/0x1e4
__kmalloc+0x33/0x8c
usb_get_status+0x2b/0xac
hub_probe+0x5e9/0xcec
usb_probe_interface+0xbf/0x21c
really_probe+0xa5/0x2c4
__driver_probe_device+0x75/0x174
driver_probe_device+0x31/0x94
__device_attach_driver+0x65/0xc0
bus_for_each_drv+0x4b/0x74
__device_attach+0x69/0x120
bus_probe_device+0x65/0x6c
device_add+0x48b/0x5f8
usb_set_configuration+0x37b/0x6b4
usb_generic_driver_probe+0x37/0x68
usb_probe_device+0x35/0xb4
Slab 0xbf622b80 objects=21 used=18 fp=0x8555cdc0 flags=0x800(slab|zone=0)
Object 0x8555cd00 @offset=3328 fp=0x00000000
Redzone 8555ccc0: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc ................
Redzone 8555ccd0: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc ................
Redzone 8555cce0: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc ................
Redzone 8555ccf0: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc ................
Object 8555cd00: 01 00 00 00 cc cc cc cc cc cc cc cc cc cc cc cc ................
Object 8555cd10: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc ................
Object 8555cd20: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc ................
Object 8555cd30: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc ................
Redzone 8555cd40: cc cc cc cc ....
Padding 8555cd74: 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a ZZZZZZZZZZZZ
CPU: 3 PID: 41 Comm: kworker/3:1 Tainted: G B 6.6.0-rc1mq-00118-g59786f827ea1 #1115
Hardware name: NVIDIA Tegra SoC (Flattened Device Tree)
Workqueue: usb_hub_wq hub_event
[<8010ca28>] (unwind_backtrace) from [<801090a5>] (show_stack+0x11/0x14)
[<801090a5>] (show_stack) from [<805da2fb>] (dump_stack_lvl+0x4d/0x7c)
[<805da2fb>] (dump_stack_lvl) from [<8026464f>] (check_bytes_and_report+0xb3/0xe4)
[<8026464f>] (check_bytes_and_report) from [<802648e1>] (check_object+0x261/0x290)
[<802648e1>] (check_object) from [<802671b1>] (free_to_partial_list+0x105/0x3f8)
[<802671b1>] (free_to_partial_list) from [<80268613>] (__kmem_cache_free+0x103/0x128)
[<80268613>] (__kmem_cache_free) from [<80425a67>] (usb_get_status+0x73/0xac)
[<80425a67>] (usb_get_status) from [<80421b31>] (hub_probe+0x5e9/0xcec)
[<80421b31>] (hub_probe) from [<80428bbb>] (usb_probe_interface+0xbf/0x21c)
[<80428bbb>] (usb_probe_interface) from [<803ee13d>] (really_probe+0xa5/0x2c4)
[<803ee13d>] (really_probe) from [<803ee3d1>] (__driver_probe_device+0x75/0x174)
[<803ee3d1>] (__driver_probe_device) from [<803ee501>] (driver_probe_device+0x31/0x94)
usb 1-1: device descriptor read/8, error -71
Fixes: fc53d5279094 ("usb: chipidea: tegra: Support host mode")
Signed-off-by: Michał Mirosław <mirq-linux@rere.qmqm.pl>
---
drivers/usb/chipidea/host.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
diff --git a/drivers/usb/chipidea/host.c b/drivers/usb/chipidea/host.c
index 08af26b762a2..abddd39d1ff1 100644
--- a/drivers/usb/chipidea/host.c
+++ b/drivers/usb/chipidea/host.c
@@ -411,12 +411,13 @@ static int ci_hdrc_alloc_dma_aligned_buffer(struct urb *urb, gfp_t mem_flags)
const unsigned int ci_hdrc_usb_dma_align = 32;
size_t kmalloc_size;
- if (urb->num_sgs || urb->sg || urb->transfer_buffer_length == 0 ||
- !((uintptr_t)urb->transfer_buffer & (ci_hdrc_usb_dma_align - 1)))
+ if (urb->num_sgs || urb->sg || urb->transfer_buffer_length == 0)
+ return 0;
+ if (!((uintptr_t)urb->transfer_buffer & (ci_hdrc_usb_dma_align - 1)) && !(urb->transfer_buffer_length & 3))
return 0;
/* Allocate a buffer with enough padding for alignment */
- kmalloc_size = urb->transfer_buffer_length +
+ kmalloc_size = ALIGN(urb->transfer_buffer_length, 4) +
sizeof(struct ci_hdrc_dma_aligned_buffer) +
ci_hdrc_usb_dma_align - 1;
--
2.39.2
^ permalink raw reply related [flat|nested] 10+ messages in thread
* [PATCH v2 2/3] usb: chipidea: Simplify Tegra DMA alignment code
2023-09-28 21:06 [PATCH v2 0/3] usb: chipidea: An USB DMA fix + cleanups for Tegra Michał Mirosław
2023-09-28 21:06 ` [PATCH v2 1/3] usb: chipidea: Fix DMA overwrite " Michał Mirosław
@ 2023-09-28 21:06 ` Michał Mirosław
2023-10-11 21:53 ` Thierry Reding
2023-09-28 21:06 ` [PATCH v2 3/3] usb: chipidea: tegra: Consistently use dev_err_probe() Michał Mirosław
2 siblings, 1 reply; 10+ messages in thread
From: Michał Mirosław @ 2023-09-28 21:06 UTC (permalink / raw)
To: Peter Geis, Dmitry Osipenko, Greg Kroah-Hartman, Peter Chen,
Thierry Reding
Cc: linux-kernel, linux-tegra, linux-usb
The USB host on Tegra3 works with 32-bit alignment. Previous code tried
to align the buffer, but it did align the wrapper struct instead, so
the buffer was at a constant offset of 8 bytes (two pointers) from
expected alignment. Since kmalloc() guarantees at least 8-byte
alignment already, the alignment-extending is removed.
Fixes: fc53d5279094 ("usb: chipidea: tegra: Support host mode")
Signed-off-by: Michał Mirosław <mirq-linux@rere.qmqm.pl>
---
drivers/usb/chipidea/host.c | 45 +++++++++++++++----------------------
1 file changed, 18 insertions(+), 27 deletions(-)
diff --git a/drivers/usb/chipidea/host.c b/drivers/usb/chipidea/host.c
index abddd39d1ff1..0cce19208370 100644
--- a/drivers/usb/chipidea/host.c
+++ b/drivers/usb/chipidea/host.c
@@ -30,8 +30,7 @@ struct ehci_ci_priv {
};
struct ci_hdrc_dma_aligned_buffer {
- void *kmalloc_ptr;
- void *old_xfer_buffer;
+ void *original_buffer;
u8 data[];
};
@@ -380,60 +379,52 @@ static int ci_ehci_bus_suspend(struct usb_hcd *hcd)
return 0;
}
-static void ci_hdrc_free_dma_aligned_buffer(struct urb *urb)
+static void ci_hdrc_free_dma_aligned_buffer(struct urb *urb, bool copy_back)
{
struct ci_hdrc_dma_aligned_buffer *temp;
- size_t length;
if (!(urb->transfer_flags & URB_ALIGNED_TEMP_BUFFER))
return;
+ urb->transfer_flags &= ~URB_ALIGNED_TEMP_BUFFER;
temp = container_of(urb->transfer_buffer,
struct ci_hdrc_dma_aligned_buffer, data);
+ urb->transfer_buffer = temp->original_buffer;
+
+ if (copy_back && usb_urb_dir_in(urb)) {
+ size_t length;
- if (usb_urb_dir_in(urb)) {
if (usb_pipeisoc(urb->pipe))
length = urb->transfer_buffer_length;
else
length = urb->actual_length;
- memcpy(temp->old_xfer_buffer, temp->data, length);
+ memcpy(temp->original_buffer, temp->data, length);
}
- urb->transfer_buffer = temp->old_xfer_buffer;
- kfree(temp->kmalloc_ptr);
- urb->transfer_flags &= ~URB_ALIGNED_TEMP_BUFFER;
+ kfree(temp);
}
static int ci_hdrc_alloc_dma_aligned_buffer(struct urb *urb, gfp_t mem_flags)
{
- struct ci_hdrc_dma_aligned_buffer *temp, *kmalloc_ptr;
- const unsigned int ci_hdrc_usb_dma_align = 32;
- size_t kmalloc_size;
+ struct ci_hdrc_dma_aligned_buffer *temp;
if (urb->num_sgs || urb->sg || urb->transfer_buffer_length == 0)
return 0;
- if (!((uintptr_t)urb->transfer_buffer & (ci_hdrc_usb_dma_align - 1)) && !(urb->transfer_buffer_length & 3))
+ if (IS_ALIGNED((uintptr_t)urb->transfer_buffer, 4)
+ && IS_ALIGNED(urb->transfer_buffer_length, 4))
return 0;
- /* Allocate a buffer with enough padding for alignment */
- kmalloc_size = ALIGN(urb->transfer_buffer_length, 4) +
- sizeof(struct ci_hdrc_dma_aligned_buffer) +
- ci_hdrc_usb_dma_align - 1;
-
- kmalloc_ptr = kmalloc(kmalloc_size, mem_flags);
- if (!kmalloc_ptr)
+ temp = kmalloc(sizeof(*temp) + ALIGN(urb->transfer_buffer_length, 4), mem_flags);
+ if (!temp)
return -ENOMEM;
- /* Position our struct dma_aligned_buffer such that data is aligned */
- temp = PTR_ALIGN(kmalloc_ptr + 1, ci_hdrc_usb_dma_align) - 1;
- temp->kmalloc_ptr = kmalloc_ptr;
- temp->old_xfer_buffer = urb->transfer_buffer;
if (usb_urb_dir_out(urb))
memcpy(temp->data, urb->transfer_buffer,
urb->transfer_buffer_length);
+
+ temp->original_buffer = urb->transfer_buffer;
urb->transfer_buffer = temp->data;
-
urb->transfer_flags |= URB_ALIGNED_TEMP_BUFFER;
return 0;
@@ -450,7 +441,7 @@ static int ci_hdrc_map_urb_for_dma(struct usb_hcd *hcd, struct urb *urb,
ret = usb_hcd_map_urb_for_dma(hcd, urb, mem_flags);
if (ret)
- ci_hdrc_free_dma_aligned_buffer(urb);
+ ci_hdrc_free_dma_aligned_buffer(urb, false);
return ret;
}
@@ -458,7 +449,7 @@ static int ci_hdrc_map_urb_for_dma(struct usb_hcd *hcd, struct urb *urb,
static void ci_hdrc_unmap_urb_for_dma(struct usb_hcd *hcd, struct urb *urb)
{
usb_hcd_unmap_urb_for_dma(hcd, urb);
- ci_hdrc_free_dma_aligned_buffer(urb);
+ ci_hdrc_free_dma_aligned_buffer(urb, true);
}
#ifdef CONFIG_PM_SLEEP
--
2.39.2
^ permalink raw reply related [flat|nested] 10+ messages in thread
* [PATCH v2 3/3] usb: chipidea: tegra: Consistently use dev_err_probe()
2023-09-28 21:06 [PATCH v2 0/3] usb: chipidea: An USB DMA fix + cleanups for Tegra Michał Mirosław
2023-09-28 21:06 ` [PATCH v2 1/3] usb: chipidea: Fix DMA overwrite " Michał Mirosław
2023-09-28 21:06 ` [PATCH v2 2/3] usb: chipidea: Simplify Tegra DMA alignment code Michał Mirosław
@ 2023-09-28 21:06 ` Michał Mirosław
2023-10-11 21:53 ` Thierry Reding
2 siblings, 1 reply; 10+ messages in thread
From: Michał Mirosław @ 2023-09-28 21:06 UTC (permalink / raw)
To: Dmitry Osipenko, Greg Kroah-Hartman, Peter Chen, Peter Geis,
Thierry Reding
Cc: linux-usb, linux-tegra, linux-kernel
Convert all error exits from probe() to dev_err_probe().
Acked-by: Peter Chen <peter.chen@kernel.org>
Signed-off-by: Michał Mirosław <mirq-linux@rere.qmqm.pl>
---
drivers/usb/chipidea/ci_hdrc_tegra.c | 16 +++++++---------
1 file changed, 7 insertions(+), 9 deletions(-)
diff --git a/drivers/usb/chipidea/ci_hdrc_tegra.c b/drivers/usb/chipidea/ci_hdrc_tegra.c
index 8e78bf643e25..2cc305803217 100644
--- a/drivers/usb/chipidea/ci_hdrc_tegra.c
+++ b/drivers/usb/chipidea/ci_hdrc_tegra.c
@@ -293,14 +293,12 @@ static int tegra_usb_probe(struct platform_device *pdev)
usb->phy = devm_usb_get_phy_by_phandle(&pdev->dev, "nvidia,phy", 0);
if (IS_ERR(usb->phy))
return dev_err_probe(&pdev->dev, PTR_ERR(usb->phy),
- "failed to get PHY\n");
+ "failed to get PHY");
usb->clk = devm_clk_get(&pdev->dev, NULL);
- if (IS_ERR(usb->clk)) {
- err = PTR_ERR(usb->clk);
- dev_err(&pdev->dev, "failed to get clock: %d\n", err);
- return err;
- }
+ if (IS_ERR(usb->clk))
+ return dev_err_probe(&pdev->dev, PTR_ERR(usb->clk),
+ "failed to get clock");
err = devm_tegra_core_dev_init_opp_table_common(&pdev->dev);
if (err)
@@ -316,7 +314,7 @@ static int tegra_usb_probe(struct platform_device *pdev)
err = tegra_usb_reset_controller(&pdev->dev);
if (err) {
- dev_err(&pdev->dev, "failed to reset controller: %d\n", err);
+ dev_err_probe(&pdev->dev, err, "failed to reset controller");
goto fail_power_off;
}
@@ -347,8 +345,8 @@ static int tegra_usb_probe(struct platform_device *pdev)
usb->dev = ci_hdrc_add_device(&pdev->dev, pdev->resource,
pdev->num_resources, &usb->data);
if (IS_ERR(usb->dev)) {
- err = PTR_ERR(usb->dev);
- dev_err(&pdev->dev, "failed to add HDRC device: %d\n", err);
+ err = dev_err_probe(&pdev->dev, PTR_ERR(usb->dev),
+ "failed to add HDRC device");
goto phy_shutdown;
}
--
2.39.2
^ permalink raw reply related [flat|nested] 10+ messages in thread
* Re: [PATCH v2 1/3] usb: chipidea: Fix DMA overwrite for Tegra
2023-09-28 21:06 ` [PATCH v2 1/3] usb: chipidea: Fix DMA overwrite " Michał Mirosław
@ 2023-10-11 21:51 ` Thierry Reding
2023-10-12 14:28 ` Peter Chen
1 sibling, 0 replies; 10+ messages in thread
From: Thierry Reding @ 2023-10-11 21:51 UTC (permalink / raw)
To: Michał Mirosław
Cc: Peter Chen, Greg Kroah-Hartman, Peter Geis, Thierry Reding,
Dmitry Osipenko, linux-usb, linux-kernel, linux-tegra
[-- Attachment #1: Type: text/plain, Size: 3779 bytes --]
On Thu, Sep 28, 2023 at 11:06:03PM +0200, Michał Mirosław wrote:
> Tegra USB controllers seem to issue DMA in full 32-bit words only and thus
> may overwrite unevenly-sized buffers. One such occurrence is detected by
> SLUB when receiving a reply to a 1-byte buffer (below). Fix this by
> allocating a bounce buffer also for buffers with sizes not a multiple of 4.
>
> =============================================================================
> BUG kmalloc-64 (Tainted: G B ): kmalloc Redzone overwritten
> -----------------------------------------------------------------------------
>
> 0x8555cd02-0x8555cd03 @offset=3330. First byte 0x0 instead of 0xcc
> Allocated in usb_get_status+0x2b/0xac age=1 cpu=3 pid=41
> __kmem_cache_alloc_node+0x12f/0x1e4
> __kmalloc+0x33/0x8c
> usb_get_status+0x2b/0xac
> hub_probe+0x5e9/0xcec
> usb_probe_interface+0xbf/0x21c
> really_probe+0xa5/0x2c4
> __driver_probe_device+0x75/0x174
> driver_probe_device+0x31/0x94
> __device_attach_driver+0x65/0xc0
> bus_for_each_drv+0x4b/0x74
> __device_attach+0x69/0x120
> bus_probe_device+0x65/0x6c
> device_add+0x48b/0x5f8
> usb_set_configuration+0x37b/0x6b4
> usb_generic_driver_probe+0x37/0x68
> usb_probe_device+0x35/0xb4
> Slab 0xbf622b80 objects=21 used=18 fp=0x8555cdc0 flags=0x800(slab|zone=0)
> Object 0x8555cd00 @offset=3328 fp=0x00000000
>
> Redzone 8555ccc0: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc ................
> Redzone 8555ccd0: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc ................
> Redzone 8555cce0: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc ................
> Redzone 8555ccf0: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc ................
> Object 8555cd00: 01 00 00 00 cc cc cc cc cc cc cc cc cc cc cc cc ................
> Object 8555cd10: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc ................
> Object 8555cd20: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc ................
> Object 8555cd30: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc ................
> Redzone 8555cd40: cc cc cc cc ....
> Padding 8555cd74: 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a ZZZZZZZZZZZZ
> CPU: 3 PID: 41 Comm: kworker/3:1 Tainted: G B 6.6.0-rc1mq-00118-g59786f827ea1 #1115
> Hardware name: NVIDIA Tegra SoC (Flattened Device Tree)
> Workqueue: usb_hub_wq hub_event
> [<8010ca28>] (unwind_backtrace) from [<801090a5>] (show_stack+0x11/0x14)
> [<801090a5>] (show_stack) from [<805da2fb>] (dump_stack_lvl+0x4d/0x7c)
> [<805da2fb>] (dump_stack_lvl) from [<8026464f>] (check_bytes_and_report+0xb3/0xe4)
> [<8026464f>] (check_bytes_and_report) from [<802648e1>] (check_object+0x261/0x290)
> [<802648e1>] (check_object) from [<802671b1>] (free_to_partial_list+0x105/0x3f8)
> [<802671b1>] (free_to_partial_list) from [<80268613>] (__kmem_cache_free+0x103/0x128)
> [<80268613>] (__kmem_cache_free) from [<80425a67>] (usb_get_status+0x73/0xac)
> [<80425a67>] (usb_get_status) from [<80421b31>] (hub_probe+0x5e9/0xcec)
> [<80421b31>] (hub_probe) from [<80428bbb>] (usb_probe_interface+0xbf/0x21c)
> [<80428bbb>] (usb_probe_interface) from [<803ee13d>] (really_probe+0xa5/0x2c4)
> [<803ee13d>] (really_probe) from [<803ee3d1>] (__driver_probe_device+0x75/0x174)
> [<803ee3d1>] (__driver_probe_device) from [<803ee501>] (driver_probe_device+0x31/0x94)
> usb 1-1: device descriptor read/8, error -71
>
> Fixes: fc53d5279094 ("usb: chipidea: tegra: Support host mode")
> Signed-off-by: Michał Mirosław <mirq-linux@rere.qmqm.pl>
> ---
> drivers/usb/chipidea/host.c | 7 ++++---
> 1 file changed, 4 insertions(+), 3 deletions(-)
Acked-by: Thierry Reding <treding@nvidia.com>
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]
^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: [PATCH v2 2/3] usb: chipidea: Simplify Tegra DMA alignment code
2023-09-28 21:06 ` [PATCH v2 2/3] usb: chipidea: Simplify Tegra DMA alignment code Michał Mirosław
@ 2023-10-11 21:53 ` Thierry Reding
2023-10-12 14:28 ` Peter Chen
2023-10-12 21:20 ` Michał Mirosław
0 siblings, 2 replies; 10+ messages in thread
From: Thierry Reding @ 2023-10-11 21:53 UTC (permalink / raw)
To: Michał Mirosław
Cc: Peter Geis, Dmitry Osipenko, Greg Kroah-Hartman, Peter Chen,
Thierry Reding, linux-kernel, linux-tegra, linux-usb
[-- Attachment #1: Type: text/plain, Size: 4695 bytes --]
On Thu, Sep 28, 2023 at 11:06:03PM +0200, Michał Mirosław wrote:
> The USB host on Tegra3 works with 32-bit alignment. Previous code tried
> to align the buffer, but it did align the wrapper struct instead, so
> the buffer was at a constant offset of 8 bytes (two pointers) from
> expected alignment. Since kmalloc() guarantees at least 8-byte
> alignment already, the alignment-extending is removed.
>
> Fixes: fc53d5279094 ("usb: chipidea: tegra: Support host mode")
> Signed-off-by: Michał Mirosław <mirq-linux@rere.qmqm.pl>
> ---
> drivers/usb/chipidea/host.c | 45 +++++++++++++++----------------------
> 1 file changed, 18 insertions(+), 27 deletions(-)
>
> diff --git a/drivers/usb/chipidea/host.c b/drivers/usb/chipidea/host.c
> index abddd39d1ff1..0cce19208370 100644
> --- a/drivers/usb/chipidea/host.c
> +++ b/drivers/usb/chipidea/host.c
> @@ -30,8 +30,7 @@ struct ehci_ci_priv {
> };
>
> struct ci_hdrc_dma_aligned_buffer {
> - void *kmalloc_ptr;
> - void *old_xfer_buffer;
> + void *original_buffer;
> u8 data[];
> };
>
> @@ -380,60 +379,52 @@ static int ci_ehci_bus_suspend(struct usb_hcd *hcd)
> return 0;
> }
>
> -static void ci_hdrc_free_dma_aligned_buffer(struct urb *urb)
> +static void ci_hdrc_free_dma_aligned_buffer(struct urb *urb, bool copy_back)
> {
> struct ci_hdrc_dma_aligned_buffer *temp;
> - size_t length;
>
> if (!(urb->transfer_flags & URB_ALIGNED_TEMP_BUFFER))
> return;
> + urb->transfer_flags &= ~URB_ALIGNED_TEMP_BUFFER;
This threw me off a bit until I realized it was already there
previously, just in a different place. Is there a particular reason why
this is moved?
Regardless, this looks fine, so:
Acked-by: Thierry Reding <treding@nvidia.com>
>
> temp = container_of(urb->transfer_buffer,
> struct ci_hdrc_dma_aligned_buffer, data);
> + urb->transfer_buffer = temp->original_buffer;
> +
> + if (copy_back && usb_urb_dir_in(urb)) {
> + size_t length;
>
> - if (usb_urb_dir_in(urb)) {
> if (usb_pipeisoc(urb->pipe))
> length = urb->transfer_buffer_length;
> else
> length = urb->actual_length;
>
> - memcpy(temp->old_xfer_buffer, temp->data, length);
> + memcpy(temp->original_buffer, temp->data, length);
> }
> - urb->transfer_buffer = temp->old_xfer_buffer;
> - kfree(temp->kmalloc_ptr);
>
> - urb->transfer_flags &= ~URB_ALIGNED_TEMP_BUFFER;
> + kfree(temp);
> }
>
> static int ci_hdrc_alloc_dma_aligned_buffer(struct urb *urb, gfp_t mem_flags)
> {
> - struct ci_hdrc_dma_aligned_buffer *temp, *kmalloc_ptr;
> - const unsigned int ci_hdrc_usb_dma_align = 32;
> - size_t kmalloc_size;
> + struct ci_hdrc_dma_aligned_buffer *temp;
>
> if (urb->num_sgs || urb->sg || urb->transfer_buffer_length == 0)
> return 0;
> - if (!((uintptr_t)urb->transfer_buffer & (ci_hdrc_usb_dma_align - 1)) && !(urb->transfer_buffer_length & 3))
> + if (IS_ALIGNED((uintptr_t)urb->transfer_buffer, 4)
> + && IS_ALIGNED(urb->transfer_buffer_length, 4))
> return 0;
>
> - /* Allocate a buffer with enough padding for alignment */
> - kmalloc_size = ALIGN(urb->transfer_buffer_length, 4) +
> - sizeof(struct ci_hdrc_dma_aligned_buffer) +
> - ci_hdrc_usb_dma_align - 1;
> -
> - kmalloc_ptr = kmalloc(kmalloc_size, mem_flags);
> - if (!kmalloc_ptr)
> + temp = kmalloc(sizeof(*temp) + ALIGN(urb->transfer_buffer_length, 4), mem_flags);
> + if (!temp)
> return -ENOMEM;
>
> - /* Position our struct dma_aligned_buffer such that data is aligned */
> - temp = PTR_ALIGN(kmalloc_ptr + 1, ci_hdrc_usb_dma_align) - 1;
> - temp->kmalloc_ptr = kmalloc_ptr;
> - temp->old_xfer_buffer = urb->transfer_buffer;
> if (usb_urb_dir_out(urb))
> memcpy(temp->data, urb->transfer_buffer,
> urb->transfer_buffer_length);
> +
> + temp->original_buffer = urb->transfer_buffer;
> urb->transfer_buffer = temp->data;
> -
> urb->transfer_flags |= URB_ALIGNED_TEMP_BUFFER;
>
> return 0;
> @@ -450,7 +441,7 @@ static int ci_hdrc_map_urb_for_dma(struct usb_hcd *hcd, struct urb *urb,
>
> ret = usb_hcd_map_urb_for_dma(hcd, urb, mem_flags);
> if (ret)
> - ci_hdrc_free_dma_aligned_buffer(urb);
> + ci_hdrc_free_dma_aligned_buffer(urb, false);
>
> return ret;
> }
> @@ -458,7 +449,7 @@ static int ci_hdrc_map_urb_for_dma(struct usb_hcd *hcd, struct urb *urb,
> static void ci_hdrc_unmap_urb_for_dma(struct usb_hcd *hcd, struct urb *urb)
> {
> usb_hcd_unmap_urb_for_dma(hcd, urb);
> - ci_hdrc_free_dma_aligned_buffer(urb);
> + ci_hdrc_free_dma_aligned_buffer(urb, true);
> }
>
> #ifdef CONFIG_PM_SLEEP
> --
> 2.39.2
>
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]
^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: [PATCH v2 3/3] usb: chipidea: tegra: Consistently use dev_err_probe()
2023-09-28 21:06 ` [PATCH v2 3/3] usb: chipidea: tegra: Consistently use dev_err_probe() Michał Mirosław
@ 2023-10-11 21:53 ` Thierry Reding
0 siblings, 0 replies; 10+ messages in thread
From: Thierry Reding @ 2023-10-11 21:53 UTC (permalink / raw)
To: Michał Mirosław
Cc: Dmitry Osipenko, Greg Kroah-Hartman, Peter Chen, Peter Geis,
Thierry Reding, linux-usb, linux-tegra, linux-kernel
[-- Attachment #1: Type: text/plain, Size: 413 bytes --]
On Thu, Sep 28, 2023 at 11:06:04PM +0200, Michał Mirosław wrote:
> Convert all error exits from probe() to dev_err_probe().
>
> Acked-by: Peter Chen <peter.chen@kernel.org>
> Signed-off-by: Michał Mirosław <mirq-linux@rere.qmqm.pl>
> ---
> drivers/usb/chipidea/ci_hdrc_tegra.c | 16 +++++++---------
> 1 file changed, 7 insertions(+), 9 deletions(-)
Acked-by: Thierry Reding <treding@nvidia.com>
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]
^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: [PATCH v2 1/3] usb: chipidea: Fix DMA overwrite for Tegra
2023-09-28 21:06 ` [PATCH v2 1/3] usb: chipidea: Fix DMA overwrite " Michał Mirosław
2023-10-11 21:51 ` Thierry Reding
@ 2023-10-12 14:28 ` Peter Chen
1 sibling, 0 replies; 10+ messages in thread
From: Peter Chen @ 2023-10-12 14:28 UTC (permalink / raw)
To: Michał Mirosław
Cc: Greg Kroah-Hartman, Peter Geis, Thierry Reding, Dmitry Osipenko,
linux-usb, linux-kernel, linux-tegra
On 23-09-28 23:06:03, Michał Mirosław wrote:
> Tegra USB controllers seem to issue DMA in full 32-bit words only and thus
> may overwrite unevenly-sized buffers. One such occurrence is detected by
> SLUB when receiving a reply to a 1-byte buffer (below). Fix this by
> allocating a bounce buffer also for buffers with sizes not a multiple of 4.
>
> =============================================================================
> BUG kmalloc-64 (Tainted: G B ): kmalloc Redzone overwritten
> -----------------------------------------------------------------------------
>
> 0x8555cd02-0x8555cd03 @offset=3330. First byte 0x0 instead of 0xcc
> Allocated in usb_get_status+0x2b/0xac age=1 cpu=3 pid=41
> __kmem_cache_alloc_node+0x12f/0x1e4
> __kmalloc+0x33/0x8c
> usb_get_status+0x2b/0xac
> hub_probe+0x5e9/0xcec
> usb_probe_interface+0xbf/0x21c
> really_probe+0xa5/0x2c4
> __driver_probe_device+0x75/0x174
> driver_probe_device+0x31/0x94
> __device_attach_driver+0x65/0xc0
> bus_for_each_drv+0x4b/0x74
> __device_attach+0x69/0x120
> bus_probe_device+0x65/0x6c
> device_add+0x48b/0x5f8
> usb_set_configuration+0x37b/0x6b4
> usb_generic_driver_probe+0x37/0x68
> usb_probe_device+0x35/0xb4
> Slab 0xbf622b80 objects=21 used=18 fp=0x8555cdc0 flags=0x800(slab|zone=0)
> Object 0x8555cd00 @offset=3328 fp=0x00000000
>
> Redzone 8555ccc0: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc ................
> Redzone 8555ccd0: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc ................
> Redzone 8555cce0: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc ................
> Redzone 8555ccf0: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc ................
> Object 8555cd00: 01 00 00 00 cc cc cc cc cc cc cc cc cc cc cc cc ................
> Object 8555cd10: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc ................
> Object 8555cd20: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc ................
> Object 8555cd30: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc ................
> Redzone 8555cd40: cc cc cc cc ....
> Padding 8555cd74: 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a ZZZZZZZZZZZZ
> CPU: 3 PID: 41 Comm: kworker/3:1 Tainted: G B 6.6.0-rc1mq-00118-g59786f827ea1 #1115
> Hardware name: NVIDIA Tegra SoC (Flattened Device Tree)
> Workqueue: usb_hub_wq hub_event
> [<8010ca28>] (unwind_backtrace) from [<801090a5>] (show_stack+0x11/0x14)
> [<801090a5>] (show_stack) from [<805da2fb>] (dump_stack_lvl+0x4d/0x7c)
> [<805da2fb>] (dump_stack_lvl) from [<8026464f>] (check_bytes_and_report+0xb3/0xe4)
> [<8026464f>] (check_bytes_and_report) from [<802648e1>] (check_object+0x261/0x290)
> [<802648e1>] (check_object) from [<802671b1>] (free_to_partial_list+0x105/0x3f8)
> [<802671b1>] (free_to_partial_list) from [<80268613>] (__kmem_cache_free+0x103/0x128)
> [<80268613>] (__kmem_cache_free) from [<80425a67>] (usb_get_status+0x73/0xac)
> [<80425a67>] (usb_get_status) from [<80421b31>] (hub_probe+0x5e9/0xcec)
> [<80421b31>] (hub_probe) from [<80428bbb>] (usb_probe_interface+0xbf/0x21c)
> [<80428bbb>] (usb_probe_interface) from [<803ee13d>] (really_probe+0xa5/0x2c4)
> [<803ee13d>] (really_probe) from [<803ee3d1>] (__driver_probe_device+0x75/0x174)
> [<803ee3d1>] (__driver_probe_device) from [<803ee501>] (driver_probe_device+0x31/0x94)
> usb 1-1: device descriptor read/8, error -71
>
> Fixes: fc53d5279094 ("usb: chipidea: tegra: Support host mode")
> Signed-off-by: Michał Mirosław <mirq-linux@rere.qmqm.pl>
Acked-by: Peter Chen <peter.chen@kernel.org>
> ---
> drivers/usb/chipidea/host.c | 7 ++++---
> 1 file changed, 4 insertions(+), 3 deletions(-)
>
> diff --git a/drivers/usb/chipidea/host.c b/drivers/usb/chipidea/host.c
> index 08af26b762a2..abddd39d1ff1 100644
> --- a/drivers/usb/chipidea/host.c
> +++ b/drivers/usb/chipidea/host.c
> @@ -411,12 +411,13 @@ static int ci_hdrc_alloc_dma_aligned_buffer(struct urb *urb, gfp_t mem_flags)
> const unsigned int ci_hdrc_usb_dma_align = 32;
> size_t kmalloc_size;
>
> - if (urb->num_sgs || urb->sg || urb->transfer_buffer_length == 0 ||
> - !((uintptr_t)urb->transfer_buffer & (ci_hdrc_usb_dma_align - 1)))
> + if (urb->num_sgs || urb->sg || urb->transfer_buffer_length == 0)
> + return 0;
> + if (!((uintptr_t)urb->transfer_buffer & (ci_hdrc_usb_dma_align - 1)) && !(urb->transfer_buffer_length & 3))
> return 0;
>
> /* Allocate a buffer with enough padding for alignment */
> - kmalloc_size = urb->transfer_buffer_length +
> + kmalloc_size = ALIGN(urb->transfer_buffer_length, 4) +
> sizeof(struct ci_hdrc_dma_aligned_buffer) +
> ci_hdrc_usb_dma_align - 1;
>
> --
> 2.39.2
>
--
Thanks,
Peter Chen
^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: [PATCH v2 2/3] usb: chipidea: Simplify Tegra DMA alignment code
2023-10-11 21:53 ` Thierry Reding
@ 2023-10-12 14:28 ` Peter Chen
2023-10-12 21:20 ` Michał Mirosław
1 sibling, 0 replies; 10+ messages in thread
From: Peter Chen @ 2023-10-12 14:28 UTC (permalink / raw)
To: Thierry Reding
Cc: Michał Mirosław, Peter Geis, Dmitry Osipenko,
Greg Kroah-Hartman, Thierry Reding, linux-kernel, linux-tegra,
linux-usb
On 23-10-11 23:53:28, Thierry Reding wrote:
> On Thu, Sep 28, 2023 at 11:06:03PM +0200, Michał Mirosław wrote:
> > The USB host on Tegra3 works with 32-bit alignment. Previous code tried
> > to align the buffer, but it did align the wrapper struct instead, so
> > the buffer was at a constant offset of 8 bytes (two pointers) from
> > expected alignment. Since kmalloc() guarantees at least 8-byte
> > alignment already, the alignment-extending is removed.
> >
> > Fixes: fc53d5279094 ("usb: chipidea: tegra: Support host mode")
> > Signed-off-by: Michał Mirosław <mirq-linux@rere.qmqm.pl>
> > ---
> > drivers/usb/chipidea/host.c | 45 +++++++++++++++----------------------
> > 1 file changed, 18 insertions(+), 27 deletions(-)
> >
> > diff --git a/drivers/usb/chipidea/host.c b/drivers/usb/chipidea/host.c
> > index abddd39d1ff1..0cce19208370 100644
> > --- a/drivers/usb/chipidea/host.c
> > +++ b/drivers/usb/chipidea/host.c
> > @@ -30,8 +30,7 @@ struct ehci_ci_priv {
> > };
> >
> > struct ci_hdrc_dma_aligned_buffer {
> > - void *kmalloc_ptr;
> > - void *old_xfer_buffer;
> > + void *original_buffer;
> > u8 data[];
> > };
> >
> > @@ -380,60 +379,52 @@ static int ci_ehci_bus_suspend(struct usb_hcd *hcd)
> > return 0;
> > }
> >
> > -static void ci_hdrc_free_dma_aligned_buffer(struct urb *urb)
> > +static void ci_hdrc_free_dma_aligned_buffer(struct urb *urb, bool copy_back)
> > {
> > struct ci_hdrc_dma_aligned_buffer *temp;
> > - size_t length;
> >
> > if (!(urb->transfer_flags & URB_ALIGNED_TEMP_BUFFER))
> > return;
> > + urb->transfer_flags &= ~URB_ALIGNED_TEMP_BUFFER;
>
> This threw me off a bit until I realized it was already there
> previously, just in a different place. Is there a particular reason why
> this is moved?
>
> Regardless, this looks fine, so:
>
> Acked-by: Thierry Reding <treding@nvidia.com>
Acked-by: Peter Chen <peter.chen@kernel.org>
--
Thanks,
Peter Chen
^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: [PATCH v2 2/3] usb: chipidea: Simplify Tegra DMA alignment code
2023-10-11 21:53 ` Thierry Reding
2023-10-12 14:28 ` Peter Chen
@ 2023-10-12 21:20 ` Michał Mirosław
1 sibling, 0 replies; 10+ messages in thread
From: Michał Mirosław @ 2023-10-12 21:20 UTC (permalink / raw)
To: Thierry Reding
Cc: Peter Geis, Dmitry Osipenko, Greg Kroah-Hartman, Peter Chen,
Thierry Reding, linux-kernel, linux-tegra, linux-usb
On Wed, Oct 11, 2023 at 11:53:28PM +0200, Thierry Reding wrote:
> On Thu, Sep 28, 2023 at 11:06:03PM +0200, Michał Mirosław wrote:
> > The USB host on Tegra3 works with 32-bit alignment. Previous code tried
> > to align the buffer, but it did align the wrapper struct instead, so
> > the buffer was at a constant offset of 8 bytes (two pointers) from
> > expected alignment. Since kmalloc() guarantees at least 8-byte
> > alignment already, the alignment-extending is removed.
> >
> > Fixes: fc53d5279094 ("usb: chipidea: tegra: Support host mode")
> > Signed-off-by: Michał Mirosław <mirq-linux@rere.qmqm.pl>
> > ---
> > drivers/usb/chipidea/host.c | 45 +++++++++++++++----------------------
> > 1 file changed, 18 insertions(+), 27 deletions(-)
> >
> > diff --git a/drivers/usb/chipidea/host.c b/drivers/usb/chipidea/host.c
> > index abddd39d1ff1..0cce19208370 100644
> > --- a/drivers/usb/chipidea/host.c
> > +++ b/drivers/usb/chipidea/host.c
> > @@ -30,8 +30,7 @@ struct ehci_ci_priv {
> > };
> >
> > struct ci_hdrc_dma_aligned_buffer {
> > - void *kmalloc_ptr;
> > - void *old_xfer_buffer;
> > + void *original_buffer;
> > u8 data[];
> > };
> >
> > @@ -380,60 +379,52 @@ static int ci_ehci_bus_suspend(struct usb_hcd *hcd)
> > return 0;
> > }
> >
> > -static void ci_hdrc_free_dma_aligned_buffer(struct urb *urb)
> > +static void ci_hdrc_free_dma_aligned_buffer(struct urb *urb, bool copy_back)
> > {
> > struct ci_hdrc_dma_aligned_buffer *temp;
> > - size_t length;
> >
> > if (!(urb->transfer_flags & URB_ALIGNED_TEMP_BUFFER))
> > return;
> > + urb->transfer_flags &= ~URB_ALIGNED_TEMP_BUFFER;
>
> This threw me off a bit until I realized it was already there
> previously, just in a different place. Is there a particular reason why
> this is moved?
I figured that it is easier to understand if the test and clear of the
URB_ALIGNED_TEMP_BUFFER bit is in a single place. Seeing it again, I
think it could be replaced with __test_and_clear_bit() in a future commit.
Best Regards
Michał Mirosław
^ permalink raw reply [flat|nested] 10+ messages in thread
end of thread, other threads:[~2023-10-12 21:21 UTC | newest]
Thread overview: 10+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2023-09-28 21:06 [PATCH v2 0/3] usb: chipidea: An USB DMA fix + cleanups for Tegra Michał Mirosław
2023-09-28 21:06 ` [PATCH v2 1/3] usb: chipidea: Fix DMA overwrite " Michał Mirosław
2023-10-11 21:51 ` Thierry Reding
2023-10-12 14:28 ` Peter Chen
2023-09-28 21:06 ` [PATCH v2 2/3] usb: chipidea: Simplify Tegra DMA alignment code Michał Mirosław
2023-10-11 21:53 ` Thierry Reding
2023-10-12 14:28 ` Peter Chen
2023-10-12 21:20 ` Michał Mirosław
2023-09-28 21:06 ` [PATCH v2 3/3] usb: chipidea: tegra: Consistently use dev_err_probe() Michał Mirosław
2023-10-11 21:53 ` Thierry Reding
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).