Commit a0e710a7 authored May 14, 2020 by Greg Kroah-Hartman

USB: usbfs: fix mmap dma mismatch



In commit 2bef9aed ("usb: usbfs: correct kernel->user page attribute
mismatch") we switched from always calling remap_pfn_range() to call
dma_mmap_coherent() to handle issues with systems with non-coherent USB host
controller drivers.  Unfortunatly, as syzbot quickly told us, not all the world
is host controllers with DMA support, so we need to check what host controller
we are attempting to talk to before doing this type of allocation.

Thanks to Christoph for the quick idea of how to fix this.

Fixes: 2bef9aed ("usb: usbfs: correct kernel->user page attribute mismatch")
Cc: Christoph Hellwig <hch@lst.de>
Cc: Hillf Danton <hdanton@sina.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Jeremy Linton <jeremy.linton@arm.com>
Cc: stable <stable@vger.kernel.org>
Reported-by:  <syzbot+353be47c9ce21b68b7ed@syzkaller.appspotmail.com>
Reviewed-by: Jeremy Linton <jeremy.linton@arm.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Link: https://lore.kernel.org/r/20200514112711.1858252-1-gregkh@linuxfoundation.org


Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

parent 1449cb2c

drivers/usb/core/devio.c

+13 −3

Original line number	Diff line number	Diff line
		@@ -251,10 +251,20 @@ static int usbdev_mmap(struct file file, struct vm_area_struct vma)
		usbm->vma_use_count = 1;
		INIT_LIST_HEAD(&usbm->memlist);

		if (dma_mmap_coherent(hcd->self.sysdev, vma, mem, dma_handle, size)) {
		if (hcd->localmem_pool \|\| !hcd_uses_dma(hcd)) {
		if (remap_pfn_range(vma, vma->vm_start,
		virt_to_phys(usbm->mem) >> PAGE_SHIFT,
		size, vma->vm_page_prot) < 0) {
		dec_usb_memory_use_count(usbm, &usbm->vma_use_count);
		return -EAGAIN;
		}
		} else {
		if (dma_mmap_coherent(hcd->self.sysdev, vma, mem, dma_handle,
		size)) {
		dec_usb_memory_use_count(usbm, &usbm->vma_use_count);
		return -EAGAIN;
		}
		}

		vma->vm_flags \|= VM_IO;
		vma->vm_flags \|= (VM_DONTEXPAND \| VM_DONTDUMP);

Admin message