From patchwork Mon Feb 18 08:29:30 2013 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jussi Kivilinna X-Patchwork-Id: 2156521 Return-Path: X-Original-To: patchwork-linux-wireless@patchwork.kernel.org Delivered-To: patchwork-process-083081@patchwork2.kernel.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by patchwork2.kernel.org (Postfix) with ESMTP id 78A32DF25A for ; Mon, 18 Feb 2013 08:29:37 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752792Ab3BRI3e (ORCPT ); Mon, 18 Feb 2013 03:29:34 -0500 Received: from sd-mail-sa-01.sanoma.fi ([158.127.18.161]:48500 "EHLO sd-mail-sa-01.sanoma.fi" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752120Ab3BRI3e (ORCPT ); Mon, 18 Feb 2013 03:29:34 -0500 Received: from localhost (localhost [127.0.0.1]) by sd-mail-sa-01.sanoma.fi (Postfix) with ESMTP id 8F4D1F2A83; Mon, 18 Feb 2013 10:29:32 +0200 (EET) Received: from sd-mail-sa-01.sanoma.fi ([127.0.0.1]) by localhost (sd-mail-sa-01.sanoma.fi [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id AZZLBUfhne0q; Mon, 18 Feb 2013 10:29:32 +0200 (EET) Received: from hayate.dalek.fi (dyn2-212-50-133-248.psoas.suomi.net [212.50.133.248]) (Authenticated sender: axh) by sd-mail-sa-01.sanoma.fi (Postfix) with ESMTPSA id 5A9C6F297F; Mon, 18 Feb 2013 10:29:31 +0200 (EET) Received: from fate.lan ([10.0.0.10] helo=fate) by hayate.dalek.fi with esmtp (Exim 4.72) (envelope-from ) id 1U7M6M-0007h2-Ue; Mon, 18 Feb 2013 10:29:31 +0200 Received: from localhost6.localdomain6 (unknown [127.0.0.1]) by fate (Postfix) with ESMTP id E14BA200842; Mon, 18 Feb 2013 10:29:30 +0200 (EET) Subject: [PATCH] [v2] rtlwifi: usb: allocate URB control message setup_packet and data buffer separately To: linux-wireless@vger.kernel.org From: Jussi Kivilinna Cc: stable@vger.kernel.org, Larry Finger Date: Mon, 18 Feb 2013 10:29:30 +0200 Message-ID: <20130218082930.17205.55004.stgit@localhost6.localdomain6> User-Agent: StGit/0.16 MIME-Version: 1.0 Sender: linux-wireless-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-wireless@vger.kernel.org rtlwifi allocates both setup_packet and data buffer of control message urb, using shared kmalloc in _usbctrl_vendorreq_async_write. Structure used for allocating is: struct { u8 data[254]; struct usb_ctrlrequest dr; }; Because 'struct usb_ctrlrequest' is __packed, setup packet is unaligned and DMA mapping of both 'data' and 'dr' confuses ARM/sunxi, leading to memory corruptions and freezes. Patch changes setup packet to be allocated separately. [v2]: - Use WARN_ON_ONCE instead of WARN_ON Cc: Signed-off-by: Jussi Kivilinna --- drivers/net/wireless/rtlwifi/usb.c | 44 +++++++++++++++++++++++------------- 1 file changed, 28 insertions(+), 16 deletions(-) -- To unsubscribe from this list: send the line "unsubscribe linux-wireless" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html diff --git a/drivers/net/wireless/rtlwifi/usb.c b/drivers/net/wireless/rtlwifi/usb.c index 476eaef..156b527 100644 --- a/drivers/net/wireless/rtlwifi/usb.c +++ b/drivers/net/wireless/rtlwifi/usb.c @@ -42,8 +42,12 @@ static void usbctrl_async_callback(struct urb *urb) { - if (urb) - kfree(urb->context); + if (urb) { + /* free dr */ + kfree(urb->setup_packet); + /* free databuf */ + kfree(urb->transfer_buffer); + } } static int _usbctrl_vendorreq_async_write(struct usb_device *udev, u8 request, @@ -55,39 +59,47 @@ static int _usbctrl_vendorreq_async_write(struct usb_device *udev, u8 request, u8 reqtype; struct usb_ctrlrequest *dr; struct urb *urb; - struct rtl819x_async_write_data { - u8 data[REALTEK_USB_VENQT_MAX_BUF_SIZE]; - struct usb_ctrlrequest dr; - } *buf; + const u16 databuf_maxlen = REALTEK_USB_VENQT_MAX_BUF_SIZE; + u8 *databuf; + + if (WARN_ON_ONCE(len > databuf_maxlen)) + len = databuf_maxlen; pipe = usb_sndctrlpipe(udev, 0); /* write_out */ reqtype = REALTEK_USB_VENQT_WRITE; - buf = kmalloc(sizeof(*buf), GFP_ATOMIC); - if (!buf) + dr = kmalloc(sizeof(*dr), GFP_ATOMIC); + if (!dr) return -ENOMEM; + databuf = kmalloc(databuf_maxlen, GFP_ATOMIC); + if (!databuf) { + kfree(dr); + return -ENOMEM; + } + urb = usb_alloc_urb(0, GFP_ATOMIC); if (!urb) { - kfree(buf); + kfree(databuf); + kfree(dr); return -ENOMEM; } - dr = &buf->dr; - dr->bRequestType = reqtype; dr->bRequest = request; dr->wValue = cpu_to_le16(value); dr->wIndex = cpu_to_le16(index); dr->wLength = cpu_to_le16(len); /* data are already in little-endian order */ - memcpy(buf, pdata, len); + memcpy(databuf, pdata, len); usb_fill_control_urb(urb, udev, pipe, - (unsigned char *)dr, buf, len, - usbctrl_async_callback, buf); + (unsigned char *)dr, databuf, len, + usbctrl_async_callback, NULL); rc = usb_submit_urb(urb, GFP_ATOMIC); - if (rc < 0) - kfree(buf); + if (rc < 0) { + kfree(databuf); + kfree(dr); + } usb_free_urb(urb); return rc; }