From patchwork Wed Nov 20 14:18:56 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Hui Wang X-Patchwork-Id: 1198187 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Authentication-Results: ozlabs.org; spf=none (no SPF record) smtp.mailfrom=lists.ubuntu.com (client-ip=91.189.94.19; helo=huckleberry.canonical.com; envelope-from=kernel-team-bounces@lists.ubuntu.com; receiver=) Authentication-Results: ozlabs.org; dmarc=fail (p=none dis=none) header.from=canonical.com Received: from huckleberry.canonical.com (huckleberry.canonical.com [91.189.94.19]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id 47J4ZM35csz9sPc; Thu, 21 Nov 2019 01:19:23 +1100 (AEDT) Received: from localhost ([127.0.0.1] helo=huckleberry.canonical.com) by huckleberry.canonical.com with esmtp (Exim 4.86_2) (envelope-from ) id 1iXQpD-0005M1-Rw; Wed, 20 Nov 2019 14:19:19 +0000 Received: from youngberry.canonical.com ([91.189.89.112]) by huckleberry.canonical.com with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.86_2) (envelope-from ) id 1iXQpB-0005LI-IW for kernel-team@lists.ubuntu.com; Wed, 20 Nov 2019 14:19:17 +0000 Received: from [114.252.208.181] (helo=localhost.localdomain) by youngberry.canonical.com with esmtpsa (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.86_2) (envelope-from ) id 1iXQpA-0001qj-Q8 for kernel-team@lists.ubuntu.com; Wed, 20 Nov 2019 14:19:17 +0000 From: Hui Wang To: kernel-team@lists.ubuntu.com Subject: [SRU][Eoan/raspi2][PATCH 1/1] UBUNTU: SAUCE: dwc_otg: checking the urb->transfer_buffer too early (#3332) Date: Wed, 20 Nov 2019 22:18:56 +0800 Message-Id: <20191120141856.4890-2-hui.wang@canonical.com> X-Mailer: git-send-email 2.17.1 In-Reply-To: <20191120141856.4890-1-hui.wang@canonical.com> References: <20191120141856.4890-1-hui.wang@canonical.com> X-BeenThere: kernel-team@lists.ubuntu.com X-Mailman-Version: 2.1.20 Precedence: list List-Id: Kernel team discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Errors-To: kernel-team-bounces@lists.ubuntu.com Sender: "kernel-team" BugLink: https://bugs.launchpad.net/bugs/1852510 After enable the HIGHMEM and VMSPLIT_3G, the dwc_otg driver doesn't work well on Pi2/3 boards with 1G physical ram. Users experience the failure when copying a file of 600M size to the USB stick. And at the same time, the dmesg shows: usb 1-1.1.2: reset high-speed USB device number 8 using dwc_otg sd 0:0:0:0: [sda] tag#0 FAILED Result: hostbyte=DID_ERROR driverbyte=DRIVER_OK blk_update_request: I/O error, dev sda, sector 3024048 op 0x1:(WRITE) flags 0x4000 phys_seg 15 prio class 0 When this happens, the sg_buf sent to the driver is located in the highmem region, the usb_sg_init() in the core/message.c will leave transfer_buffer to NULL if the sg_buf is in highmem, but in the dwc_otg driver, it returns -EINVAL unconditionally if transfer_buffer is NULL. The driver can handle the situation of buffer to be NULL, if it is in DMA mode, it will convert an address from transfer_dma. But if the conversion fails or it is in the PIO mode, we should check buffer and return -EINVAL if it is NULL. https://github.com/raspberrypi/linux/pull/3341 BugLink: https://bugs.launchpad.net/bugs/1852510 Signed-off-by: Hui Wang Acked-by: Connor Kuehl Acked-by: Stefan Bader --- drivers/usb/host/dwc_otg/dwc_otg_hcd_linux.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/drivers/usb/host/dwc_otg/dwc_otg_hcd_linux.c b/drivers/usb/host/dwc_otg/dwc_otg_hcd_linux.c index 08a3e41038a3..ffa8cb2ad49a 100644 --- a/drivers/usb/host/dwc_otg/dwc_otg_hcd_linux.c +++ b/drivers/usb/host/dwc_otg/dwc_otg_hcd_linux.c @@ -821,10 +821,6 @@ static int dwc_otg_urb_enqueue(struct usb_hcd *hcd, dump_urb_info(urb, "dwc_otg_urb_enqueue"); } #endif - - if (!urb->transfer_buffer && urb->transfer_buffer_length) - return -EINVAL; - if ((usb_pipetype(urb->pipe) == PIPE_ISOCHRONOUS) || (usb_pipetype(urb->pipe) == PIPE_INTERRUPT)) { if (!dwc_otg_hcd_is_bandwidth_allocated @@ -881,6 +877,13 @@ static int dwc_otg_urb_enqueue(struct usb_hcd *hcd, &urb->transfer_dma, buf); } + if (!buf && urb->transfer_buffer_length) { + DWC_FREE(dwc_otg_urb); + DWC_ERROR("transfer_buffer is NULL in PIO mode or both " + "transfer_buffer and transfer_dma are NULL in DMA mode\n"); + return -EINVAL; + } + if (!(urb->transfer_flags & URB_NO_INTERRUPT)) flags |= URB_GIVEBACK_ASAP; if (urb->transfer_flags & URB_ZERO_PACKET)