usb: core: Check URB setup_packet and transfer_buffer sanity (45681366) · Commits · 戴 / test

Update usb_hcd_map_urb_for_dma() to check for an URB's setup_packet and transfer_buffer sanity. We first check that urb->setup_packet is neither coming from vmalloc space nor is an on stack buffer, and if that's the case, produce a warning and return an error. For urb->transfer_buffer there is an existing is_vmalloc_addr() check so we just supplement that with an object_is_on_stack() check, produce a warning if that is the case and also return an error. Signed-off-by:

Florian Fainelli <f.fainelli@gmail.com> Signed-off-by:

Greg Kroah-Hartman <gregkh@linuxfoundation.org>

drivers/usb/core/hcd.c

+12 −0

Original line number	Diff line number	Diff line
		@@ -26,6 +26,7 @@
		#include <linux/module.h>
		#include <linux/version.h>
		#include <linux/kernel.h>
		#include <linux/sched/task_stack.h>
		#include <linux/slab.h>
		#include <linux/completion.h>
		#include <linux/utsname.h>
		@@ -1523,6 +1524,14 @@ int usb_hcd_map_urb_for_dma(struct usb_hcd hcd, struct urb urb,
		if (hcd->self.uses_pio_for_control)
		return ret;
		if (IS_ENABLED(CONFIG_HAS_DMA) && hcd->self.uses_dma) {
		if (is_vmalloc_addr(urb->setup_packet)) {
		WARN_ONCE(1, "setup packet is not dma capable\n");
		return -EAGAIN;
		} else if (object_is_on_stack(urb->setup_packet)) {
		WARN_ONCE(1, "setup packet is on stack\n");
		return -EAGAIN;
		}

		urb->setup_dma = dma_map_single(
		hcd->self.sysdev,
		urb->setup_packet,
		@@ -1587,6 +1596,9 @@ int usb_hcd_map_urb_for_dma(struct usb_hcd hcd, struct urb urb,
		} else if (is_vmalloc_addr(urb->transfer_buffer)) {
		WARN_ONCE(1, "transfer buffer not dma capable\n");
		ret = -EAGAIN;
		} else if (object_is_on_stack(urb->transfer_buffer)) {
		WARN_ONCE(1, "transfer buffer is on stack\n");
		ret = -EAGAIN;
		} else {
		urb->transfer_dma = dma_map_single(
		hcd->self.sysdev,

Admin message