From 4568136620c6482bcd4a6b0cd6ae8e5679615d7e Mon Sep 17 00:00:00 2001 From: Florian Fainelli Date: Tue, 25 Apr 2017 17:56:11 -0700 Subject: [PATCH] usb: core: Check URB setup_packet and transfer_buffer sanity Update usb_hcd_map_urb_for_dma() to check for an URB's setup_packet and transfer_buffer sanity. We first check that urb->setup_packet is neither coming from vmalloc space nor is an on stack buffer, and if that's the case, produce a warning and return an error. For urb->transfer_buffer there is an existing is_vmalloc_addr() check so we just supplement that with an object_is_on_stack() check, produce a warning if that is the case and also return an error. Signed-off-by: Florian Fainelli Signed-off-by: Greg Kroah-Hartman --- drivers/usb/core/hcd.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/drivers/usb/core/hcd.c b/drivers/usb/core/hcd.c index 49550790a3cb..26d710eec7da 100644 --- a/drivers/usb/core/hcd.c +++ b/drivers/usb/core/hcd.c @@ -26,6 +26,7 @@ #include #include #include +#include #include #include #include @@ -1523,6 +1524,14 @@ int usb_hcd_map_urb_for_dma(struct usb_hcd *hcd, struct urb *urb, if (hcd->self.uses_pio_for_control) return ret; if (IS_ENABLED(CONFIG_HAS_DMA) && hcd->self.uses_dma) { + if (is_vmalloc_addr(urb->setup_packet)) { + WARN_ONCE(1, "setup packet is not dma capable\n"); + return -EAGAIN; + } else if (object_is_on_stack(urb->setup_packet)) { + WARN_ONCE(1, "setup packet is on stack\n"); + return -EAGAIN; + } + urb->setup_dma = dma_map_single( hcd->self.sysdev, urb->setup_packet, @@ -1587,6 +1596,9 @@ int usb_hcd_map_urb_for_dma(struct usb_hcd *hcd, struct urb *urb, } else if (is_vmalloc_addr(urb->transfer_buffer)) { WARN_ONCE(1, "transfer buffer not dma capable\n"); ret = -EAGAIN; + } else if (object_is_on_stack(urb->transfer_buffer)) { + WARN_ONCE(1, "transfer buffer is on stack\n"); + ret = -EAGAIN; } else { urb->transfer_dma = dma_map_single( hcd->self.sysdev, -- 2.25.1