From patchwork Thu May 14 11:27:11 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Greg Kroah-Hartman X-Patchwork-Id: 11548523 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 23C47139A for ; Thu, 14 May 2020 11:27:32 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 0D6F520734 for ; Thu, 14 May 2020 11:27:32 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1589455652; bh=lb1wILpxMnk2dDKyaT9/I0hBKKuiQ8NqaXhAMd1Q6S8=; h=From:To:Cc:Subject:Date:List-ID:From; b=ETs3ir6qQcH2wDkbv+wijqVFCV+bB75l4uHgnHQToKXu4FncdMVHVDzM87mG4qajZ kV8j3xsAJ4cJOGZC6Wk7SYN8GcW+bwGP0wvtP4SMS0yX0l5VykicX+yZ0bKeD8s/vY hY+4BtO5mUdVT7hv9Ptgxb83U4ycWgCBJcvjYwLA= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726241AbgENL13 (ORCPT ); Thu, 14 May 2020 07:27:29 -0400 Received: from mail.kernel.org ([198.145.29.99]:51250 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726051AbgENL1Z (ORCPT ); Thu, 14 May 2020 07:27:25 -0400 Received: from localhost (83-86-89-107.cable.dynamic.v4.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id F16FC206A5; Thu, 14 May 2020 11:27:23 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1589455644; bh=lb1wILpxMnk2dDKyaT9/I0hBKKuiQ8NqaXhAMd1Q6S8=; h=From:To:Cc:Subject:Date:From; b=jlxWWmcoplhtpNO8NT/phR6Z+E6qgXXqonoospaP5cvfpEK5qHLTzJ0ge5FzXeGsM LIPRtO2WwqLM0xwU4zTjDKGWK/7JSHGzvgTxSMePIr5XdUw1c7AkxVxUSP1h3CUEuZ vA9wGo5cvKaK8kBTNEznr/v3ilTRmRXcXbtiBK64= From: Greg Kroah-Hartman To: linux-usb@vger.kernel.org, linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , Christoph Hellwig , Hillf Danton , Thomas Gleixner , Jeremy Linton , syzbot+353be47c9ce21b68b7ed@syzkaller.appspotmail.com, stable Subject: [PATCH] USB: usbfs: fix mmap dma mismatch Date: Thu, 14 May 2020 13:27:11 +0200 Message-Id: <20200514112711.1858252-1-gregkh@linuxfoundation.org> X-Mailer: git-send-email 2.26.2 MIME-Version: 1.0 Sender: linux-usb-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-usb@vger.kernel.org In commit 2bef9aed6f0e ("usb: usbfs: correct kernel->user page attribute mismatch") we switched from always calling remap_pfn_range() to call dma_mmap_coherent() to handle issues with systems with non-coherent USB host controller drivers. Unfortunatly, as syzbot quickly told us, not all the world is host controllers with DMA support, so we need to check what host controller we are attempting to talk to before doing this type of allocation. Thanks to Christoph for the quick idea of how to fix this. Cc: Christoph Hellwig Cc: Hillf Danton Cc: Thomas Gleixner Cc: Jeremy Linton Reported-by: syzbot+353be47c9ce21b68b7ed@syzkaller.appspotmail.com Fixes: 2bef9aed6f0e ("usb: usbfs: correct kernel->user page attribute mismatch") Cc: stable Signed-off-by: Greg Kroah-Hartman Reviewed-by: Jeremy Linton Reviewed-by: Christoph Hellwig --- drivers/usb/core/devio.c | 16 +++++++++++++--- 1 file changed, 13 insertions(+), 3 deletions(-) diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c index b9db9812d6c5..d93d94d7ff50 100644 --- a/drivers/usb/core/devio.c +++ b/drivers/usb/core/devio.c @@ -251,9 +251,19 @@ static int usbdev_mmap(struct file *file, struct vm_area_struct *vma) usbm->vma_use_count = 1; INIT_LIST_HEAD(&usbm->memlist); - if (dma_mmap_coherent(hcd->self.sysdev, vma, mem, dma_handle, size)) { - dec_usb_memory_use_count(usbm, &usbm->vma_use_count); - return -EAGAIN; + if (hcd->localmem_pool || !hcd_uses_dma(hcd)) { + if (remap_pfn_range(vma, vma->vm_start, + virt_to_phys(usbm->mem) >> PAGE_SHIFT, + size, vma->vm_page_prot) < 0) { + dec_usb_memory_use_count(usbm, &usbm->vma_use_count); + return -EAGAIN; + } + } else { + if (dma_mmap_coherent(hcd->self.sysdev, vma, mem, dma_handle, + size)) { + dec_usb_memory_use_count(usbm, &usbm->vma_use_count); + return -EAGAIN; + } } vma->vm_flags |= VM_IO;