diff options
Diffstat (limited to 'target')
10 files changed, 490 insertions, 0 deletions
diff --git a/target/linux/generic/patches-3.10/007-hso-Earlier-catch-of-error-condition.patch b/target/linux/generic/patches-3.10/007-hso-Earlier-catch-of-error-condition.patch new file mode 100644 index 0000000000..9b31caf06f --- /dev/null +++ b/target/linux/generic/patches-3.10/007-hso-Earlier-catch-of-error-condition.patch @@ -0,0 +1,45 @@ +From 35e57e1b49a351aa804dab6010cd46ae6112a541 Mon Sep 17 00:00:00 2001 +From: Daniel Gimpelevich <daniel@gimpelevich.san-francisco.ca.us> +Date: Wed, 21 Aug 2013 01:43:07 -0700 +Subject: [PATCH 1/2] hso: Earlier catch of error condition + +There is no need to get an interface specification if we know it's the +wrong one. + +Signed-off-by: Daniel Gimpelevich <daniel@gimpelevich.san-francisco.ca.us> +Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> +Signed-off-by: David S. Miller <davem@davemloft.net> +--- + drivers/net/usb/hso.c | 9 +++++---- + 1 file changed, 5 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/usb/hso.c b/drivers/net/usb/hso.c +index cba1d46..5fb36ed 100644 +--- a/drivers/net/usb/hso.c ++++ b/drivers/net/usb/hso.c +@@ -2886,6 +2886,11 @@ static int hso_probe(struct usb_interface *interface, + struct hso_shared_int *shared_int; + struct hso_device *tmp_dev = NULL; + ++ if (interface->cur_altsetting->desc.bInterfaceClass != 0xFF) { ++ dev_err(&interface->dev, "Not our interface\n"); ++ return -ENODEV; ++ } ++ + if_num = interface->altsetting->desc.bInterfaceNumber; + + /* Get the interface/port specification from either driver_info or from +@@ -2895,10 +2900,6 @@ static int hso_probe(struct usb_interface *interface, + else + port_spec = hso_get_config_data(interface); + +- if (interface->cur_altsetting->desc.bInterfaceClass != 0xFF) { +- dev_err(&interface->dev, "Not our interface\n"); +- return -ENODEV; +- } + /* Check if we need to switch to alt interfaces prior to port + * configuration */ + if (interface->num_altsetting > 1) +-- +1.7.9.5 + diff --git a/target/linux/generic/patches-3.10/008-hso-Fix-stack-corruption-on-some-architectures.patch b/target/linux/generic/patches-3.10/008-hso-Fix-stack-corruption-on-some-architectures.patch new file mode 100644 index 0000000000..c6da3c1c30 --- /dev/null +++ b/target/linux/generic/patches-3.10/008-hso-Fix-stack-corruption-on-some-architectures.patch @@ -0,0 +1,53 @@ +From e75dc677ff8d06ffa61bef6fee436227ae5440c6 Mon Sep 17 00:00:00 2001 +From: Daniel Gimpelevich <daniel@gimpelevich.san-francisco.ca.us> +Date: Wed, 21 Aug 2013 01:43:19 -0700 +Subject: [PATCH 2/2] hso: Fix stack corruption on some architectures + +As Sergei Shtylyov explained in the #mipslinux IRC channel: +[Mon 2013-08-19 12:28:21 PM PDT] <headless> guys, are you sure it's not "DMA off stack" case? +[Mon 2013-08-19 12:28:35 PM PDT] <headless> it's a known stack corruptor on non-coherent arches +[Mon 2013-08-19 12:31:48 PM PDT] <DonkeyHotei> headless: for usb/ehci? +[Mon 2013-08-19 12:34:11 PM PDT] <DonkeyHotei> headless: explain +[Mon 2013-08-19 12:35:38 PM PDT] <headless> usb_control_msg() (or other such func) should not use buffer on stack. DMA from/to stack is prohibited +[Mon 2013-08-19 12:35:58 PM PDT] <headless> and EHCI uses DMA on control xfers (as well as all the others) + +Signed-off-by: Daniel Gimpelevich <daniel@gimpelevich.san-francisco.ca.us> +Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> +Signed-off-by: David S. Miller <davem@davemloft.net> +--- + drivers/net/usb/hso.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/usb/hso.c b/drivers/net/usb/hso.c +index 5fb36ed..86292e6 100644 +--- a/drivers/net/usb/hso.c ++++ b/drivers/net/usb/hso.c +@@ -2816,13 +2816,16 @@ exit: + static int hso_get_config_data(struct usb_interface *interface) + { + struct usb_device *usbdev = interface_to_usbdev(interface); +- u8 config_data[17]; ++ u8 *config_data = kmalloc(17, GFP_KERNEL); + u32 if_num = interface->altsetting->desc.bInterfaceNumber; + s32 result; + ++ if (!config_data) ++ return -ENOMEM; + if (usb_control_msg(usbdev, usb_rcvctrlpipe(usbdev, 0), + 0x86, 0xC0, 0, 0, config_data, 17, + USB_CTRL_SET_TIMEOUT) != 0x11) { ++ kfree(config_data); + return -EIO; + } + +@@ -2873,6 +2876,7 @@ static int hso_get_config_data(struct usb_interface *interface) + if (config_data[16] & 0x1) + result |= HSO_INFO_CRC_BUG; + ++ kfree(config_data); + return result; + } + +-- +1.7.9.5 + diff --git a/target/linux/generic/patches-3.3/007-hso-Earlier-catch-of-error-condition.patch b/target/linux/generic/patches-3.3/007-hso-Earlier-catch-of-error-condition.patch new file mode 100644 index 0000000000..9b31caf06f --- /dev/null +++ b/target/linux/generic/patches-3.3/007-hso-Earlier-catch-of-error-condition.patch @@ -0,0 +1,45 @@ +From 35e57e1b49a351aa804dab6010cd46ae6112a541 Mon Sep 17 00:00:00 2001 +From: Daniel Gimpelevich <daniel@gimpelevich.san-francisco.ca.us> +Date: Wed, 21 Aug 2013 01:43:07 -0700 +Subject: [PATCH 1/2] hso: Earlier catch of error condition + +There is no need to get an interface specification if we know it's the +wrong one. + +Signed-off-by: Daniel Gimpelevich <daniel@gimpelevich.san-francisco.ca.us> +Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> +Signed-off-by: David S. Miller <davem@davemloft.net> +--- + drivers/net/usb/hso.c | 9 +++++---- + 1 file changed, 5 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/usb/hso.c b/drivers/net/usb/hso.c +index cba1d46..5fb36ed 100644 +--- a/drivers/net/usb/hso.c ++++ b/drivers/net/usb/hso.c +@@ -2886,6 +2886,11 @@ static int hso_probe(struct usb_interface *interface, + struct hso_shared_int *shared_int; + struct hso_device *tmp_dev = NULL; + ++ if (interface->cur_altsetting->desc.bInterfaceClass != 0xFF) { ++ dev_err(&interface->dev, "Not our interface\n"); ++ return -ENODEV; ++ } ++ + if_num = interface->altsetting->desc.bInterfaceNumber; + + /* Get the interface/port specification from either driver_info or from +@@ -2895,10 +2900,6 @@ static int hso_probe(struct usb_interface *interface, + else + port_spec = hso_get_config_data(interface); + +- if (interface->cur_altsetting->desc.bInterfaceClass != 0xFF) { +- dev_err(&interface->dev, "Not our interface\n"); +- return -ENODEV; +- } + /* Check if we need to switch to alt interfaces prior to port + * configuration */ + if (interface->num_altsetting > 1) +-- +1.7.9.5 + diff --git a/target/linux/generic/patches-3.3/008-hso-Fix-stack-corruption-on-some-architectures.patch b/target/linux/generic/patches-3.3/008-hso-Fix-stack-corruption-on-some-architectures.patch new file mode 100644 index 0000000000..c6da3c1c30 --- /dev/null +++ b/target/linux/generic/patches-3.3/008-hso-Fix-stack-corruption-on-some-architectures.patch @@ -0,0 +1,53 @@ +From e75dc677ff8d06ffa61bef6fee436227ae5440c6 Mon Sep 17 00:00:00 2001 +From: Daniel Gimpelevich <daniel@gimpelevich.san-francisco.ca.us> +Date: Wed, 21 Aug 2013 01:43:19 -0700 +Subject: [PATCH 2/2] hso: Fix stack corruption on some architectures + +As Sergei Shtylyov explained in the #mipslinux IRC channel: +[Mon 2013-08-19 12:28:21 PM PDT] <headless> guys, are you sure it's not "DMA off stack" case? +[Mon 2013-08-19 12:28:35 PM PDT] <headless> it's a known stack corruptor on non-coherent arches +[Mon 2013-08-19 12:31:48 PM PDT] <DonkeyHotei> headless: for usb/ehci? +[Mon 2013-08-19 12:34:11 PM PDT] <DonkeyHotei> headless: explain +[Mon 2013-08-19 12:35:38 PM PDT] <headless> usb_control_msg() (or other such func) should not use buffer on stack. DMA from/to stack is prohibited +[Mon 2013-08-19 12:35:58 PM PDT] <headless> and EHCI uses DMA on control xfers (as well as all the others) + +Signed-off-by: Daniel Gimpelevich <daniel@gimpelevich.san-francisco.ca.us> +Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> +Signed-off-by: David S. Miller <davem@davemloft.net> +--- + drivers/net/usb/hso.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/usb/hso.c b/drivers/net/usb/hso.c +index 5fb36ed..86292e6 100644 +--- a/drivers/net/usb/hso.c ++++ b/drivers/net/usb/hso.c +@@ -2816,13 +2816,16 @@ exit: + static int hso_get_config_data(struct usb_interface *interface) + { + struct usb_device *usbdev = interface_to_usbdev(interface); +- u8 config_data[17]; ++ u8 *config_data = kmalloc(17, GFP_KERNEL); + u32 if_num = interface->altsetting->desc.bInterfaceNumber; + s32 result; + ++ if (!config_data) ++ return -ENOMEM; + if (usb_control_msg(usbdev, usb_rcvctrlpipe(usbdev, 0), + 0x86, 0xC0, 0, 0, config_data, 17, + USB_CTRL_SET_TIMEOUT) != 0x11) { ++ kfree(config_data); + return -EIO; + } + +@@ -2873,6 +2876,7 @@ static int hso_get_config_data(struct usb_interface *interface) + if (config_data[16] & 0x1) + result |= HSO_INFO_CRC_BUG; + ++ kfree(config_data); + return result; + } + +-- +1.7.9.5 + diff --git a/target/linux/generic/patches-3.6/007-hso-Earlier-catch-of-error-condition.patch b/target/linux/generic/patches-3.6/007-hso-Earlier-catch-of-error-condition.patch new file mode 100644 index 0000000000..9b31caf06f --- /dev/null +++ b/target/linux/generic/patches-3.6/007-hso-Earlier-catch-of-error-condition.patch @@ -0,0 +1,45 @@ +From 35e57e1b49a351aa804dab6010cd46ae6112a541 Mon Sep 17 00:00:00 2001 +From: Daniel Gimpelevich <daniel@gimpelevich.san-francisco.ca.us> +Date: Wed, 21 Aug 2013 01:43:07 -0700 +Subject: [PATCH 1/2] hso: Earlier catch of error condition + +There is no need to get an interface specification if we know it's the +wrong one. + +Signed-off-by: Daniel Gimpelevich <daniel@gimpelevich.san-francisco.ca.us> +Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> +Signed-off-by: David S. Miller <davem@davemloft.net> +--- + drivers/net/usb/hso.c | 9 +++++---- + 1 file changed, 5 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/usb/hso.c b/drivers/net/usb/hso.c +index cba1d46..5fb36ed 100644 +--- a/drivers/net/usb/hso.c ++++ b/drivers/net/usb/hso.c +@@ -2886,6 +2886,11 @@ static int hso_probe(struct usb_interface *interface, + struct hso_shared_int *shared_int; + struct hso_device *tmp_dev = NULL; + ++ if (interface->cur_altsetting->desc.bInterfaceClass != 0xFF) { ++ dev_err(&interface->dev, "Not our interface\n"); ++ return -ENODEV; ++ } ++ + if_num = interface->altsetting->desc.bInterfaceNumber; + + /* Get the interface/port specification from either driver_info or from +@@ -2895,10 +2900,6 @@ static int hso_probe(struct usb_interface *interface, + else + port_spec = hso_get_config_data(interface); + +- if (interface->cur_altsetting->desc.bInterfaceClass != 0xFF) { +- dev_err(&interface->dev, "Not our interface\n"); +- return -ENODEV; +- } + /* Check if we need to switch to alt interfaces prior to port + * configuration */ + if (interface->num_altsetting > 1) +-- +1.7.9.5 + diff --git a/target/linux/generic/patches-3.6/008-hso-Fix-stack-corruption-on-some-architectures.patch b/target/linux/generic/patches-3.6/008-hso-Fix-stack-corruption-on-some-architectures.patch new file mode 100644 index 0000000000..c6da3c1c30 --- /dev/null +++ b/target/linux/generic/patches-3.6/008-hso-Fix-stack-corruption-on-some-architectures.patch @@ -0,0 +1,53 @@ +From e75dc677ff8d06ffa61bef6fee436227ae5440c6 Mon Sep 17 00:00:00 2001 +From: Daniel Gimpelevich <daniel@gimpelevich.san-francisco.ca.us> +Date: Wed, 21 Aug 2013 01:43:19 -0700 +Subject: [PATCH 2/2] hso: Fix stack corruption on some architectures + +As Sergei Shtylyov explained in the #mipslinux IRC channel: +[Mon 2013-08-19 12:28:21 PM PDT] <headless> guys, are you sure it's not "DMA off stack" case? +[Mon 2013-08-19 12:28:35 PM PDT] <headless> it's a known stack corruptor on non-coherent arches +[Mon 2013-08-19 12:31:48 PM PDT] <DonkeyHotei> headless: for usb/ehci? +[Mon 2013-08-19 12:34:11 PM PDT] <DonkeyHotei> headless: explain +[Mon 2013-08-19 12:35:38 PM PDT] <headless> usb_control_msg() (or other such func) should not use buffer on stack. DMA from/to stack is prohibited +[Mon 2013-08-19 12:35:58 PM PDT] <headless> and EHCI uses DMA on control xfers (as well as all the others) + +Signed-off-by: Daniel Gimpelevich <daniel@gimpelevich.san-francisco.ca.us> +Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> +Signed-off-by: David S. Miller <davem@davemloft.net> +--- + drivers/net/usb/hso.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/usb/hso.c b/drivers/net/usb/hso.c +index 5fb36ed..86292e6 100644 +--- a/drivers/net/usb/hso.c ++++ b/drivers/net/usb/hso.c +@@ -2816,13 +2816,16 @@ exit: + static int hso_get_config_data(struct usb_interface *interface) + { + struct usb_device *usbdev = interface_to_usbdev(interface); +- u8 config_data[17]; ++ u8 *config_data = kmalloc(17, GFP_KERNEL); + u32 if_num = interface->altsetting->desc.bInterfaceNumber; + s32 result; + ++ if (!config_data) ++ return -ENOMEM; + if (usb_control_msg(usbdev, usb_rcvctrlpipe(usbdev, 0), + 0x86, 0xC0, 0, 0, config_data, 17, + USB_CTRL_SET_TIMEOUT) != 0x11) { ++ kfree(config_data); + return -EIO; + } + +@@ -2873,6 +2876,7 @@ static int hso_get_config_data(struct usb_interface *interface) + if (config_data[16] & 0x1) + result |= HSO_INFO_CRC_BUG; + ++ kfree(config_data); + return result; + } + +-- +1.7.9.5 + diff --git a/target/linux/generic/patches-3.8/007-hso-Earlier-catch-of-error-condition.patch b/target/linux/generic/patches-3.8/007-hso-Earlier-catch-of-error-condition.patch new file mode 100644 index 0000000000..9b31caf06f --- /dev/null +++ b/target/linux/generic/patches-3.8/007-hso-Earlier-catch-of-error-condition.patch @@ -0,0 +1,45 @@ +From 35e57e1b49a351aa804dab6010cd46ae6112a541 Mon Sep 17 00:00:00 2001 +From: Daniel Gimpelevich <daniel@gimpelevich.san-francisco.ca.us> +Date: Wed, 21 Aug 2013 01:43:07 -0700 +Subject: [PATCH 1/2] hso: Earlier catch of error condition + +There is no need to get an interface specification if we know it's the +wrong one. + +Signed-off-by: Daniel Gimpelevich <daniel@gimpelevich.san-francisco.ca.us> +Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> +Signed-off-by: David S. Miller <davem@davemloft.net> +--- + drivers/net/usb/hso.c | 9 +++++---- + 1 file changed, 5 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/usb/hso.c b/drivers/net/usb/hso.c +index cba1d46..5fb36ed 100644 +--- a/drivers/net/usb/hso.c ++++ b/drivers/net/usb/hso.c +@@ -2886,6 +2886,11 @@ static int hso_probe(struct usb_interface *interface, + struct hso_shared_int *shared_int; + struct hso_device *tmp_dev = NULL; + ++ if (interface->cur_altsetting->desc.bInterfaceClass != 0xFF) { ++ dev_err(&interface->dev, "Not our interface\n"); ++ return -ENODEV; ++ } ++ + if_num = interface->altsetting->desc.bInterfaceNumber; + + /* Get the interface/port specification from either driver_info or from +@@ -2895,10 +2900,6 @@ static int hso_probe(struct usb_interface *interface, + else + port_spec = hso_get_config_data(interface); + +- if (interface->cur_altsetting->desc.bInterfaceClass != 0xFF) { +- dev_err(&interface->dev, "Not our interface\n"); +- return -ENODEV; +- } + /* Check if we need to switch to alt interfaces prior to port + * configuration */ + if (interface->num_altsetting > 1) +-- +1.7.9.5 + diff --git a/target/linux/generic/patches-3.8/008-hso-Fix-stack-corruption-on-some-architectures.patch b/target/linux/generic/patches-3.8/008-hso-Fix-stack-corruption-on-some-architectures.patch new file mode 100644 index 0000000000..c6da3c1c30 --- /dev/null +++ b/target/linux/generic/patches-3.8/008-hso-Fix-stack-corruption-on-some-architectures.patch @@ -0,0 +1,53 @@ +From e75dc677ff8d06ffa61bef6fee436227ae5440c6 Mon Sep 17 00:00:00 2001 +From: Daniel Gimpelevich <daniel@gimpelevich.san-francisco.ca.us> +Date: Wed, 21 Aug 2013 01:43:19 -0700 +Subject: [PATCH 2/2] hso: Fix stack corruption on some architectures + +As Sergei Shtylyov explained in the #mipslinux IRC channel: +[Mon 2013-08-19 12:28:21 PM PDT] <headless> guys, are you sure it's not "DMA off stack" case? +[Mon 2013-08-19 12:28:35 PM PDT] <headless> it's a known stack corruptor on non-coherent arches +[Mon 2013-08-19 12:31:48 PM PDT] <DonkeyHotei> headless: for usb/ehci? +[Mon 2013-08-19 12:34:11 PM PDT] <DonkeyHotei> headless: explain +[Mon 2013-08-19 12:35:38 PM PDT] <headless> usb_control_msg() (or other such func) should not use buffer on stack. DMA from/to stack is prohibited +[Mon 2013-08-19 12:35:58 PM PDT] <headless> and EHCI uses DMA on control xfers (as well as all the others) + +Signed-off-by: Daniel Gimpelevich <daniel@gimpelevich.san-francisco.ca.us> +Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> +Signed-off-by: David S. Miller <davem@davemloft.net> +--- + drivers/net/usb/hso.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/usb/hso.c b/drivers/net/usb/hso.c +index 5fb36ed..86292e6 100644 +--- a/drivers/net/usb/hso.c ++++ b/drivers/net/usb/hso.c +@@ -2816,13 +2816,16 @@ exit: + static int hso_get_config_data(struct usb_interface *interface) + { + struct usb_device *usbdev = interface_to_usbdev(interface); +- u8 config_data[17]; ++ u8 *config_data = kmalloc(17, GFP_KERNEL); + u32 if_num = interface->altsetting->desc.bInterfaceNumber; + s32 result; + ++ if (!config_data) ++ return -ENOMEM; + if (usb_control_msg(usbdev, usb_rcvctrlpipe(usbdev, 0), + 0x86, 0xC0, 0, 0, config_data, 17, + USB_CTRL_SET_TIMEOUT) != 0x11) { ++ kfree(config_data); + return -EIO; + } + +@@ -2873,6 +2876,7 @@ static int hso_get_config_data(struct usb_interface *interface) + if (config_data[16] & 0x1) + result |= HSO_INFO_CRC_BUG; + ++ kfree(config_data); + return result; + } + +-- +1.7.9.5 + diff --git a/target/linux/generic/patches-3.9/007-hso-Earlier-catch-of-error-condition.patch b/target/linux/generic/patches-3.9/007-hso-Earlier-catch-of-error-condition.patch new file mode 100644 index 0000000000..9b31caf06f --- /dev/null +++ b/target/linux/generic/patches-3.9/007-hso-Earlier-catch-of-error-condition.patch @@ -0,0 +1,45 @@ +From 35e57e1b49a351aa804dab6010cd46ae6112a541 Mon Sep 17 00:00:00 2001 +From: Daniel Gimpelevich <daniel@gimpelevich.san-francisco.ca.us> +Date: Wed, 21 Aug 2013 01:43:07 -0700 +Subject: [PATCH 1/2] hso: Earlier catch of error condition + +There is no need to get an interface specification if we know it's the +wrong one. + +Signed-off-by: Daniel Gimpelevich <daniel@gimpelevich.san-francisco.ca.us> +Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> +Signed-off-by: David S. Miller <davem@davemloft.net> +--- + drivers/net/usb/hso.c | 9 +++++---- + 1 file changed, 5 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/usb/hso.c b/drivers/net/usb/hso.c +index cba1d46..5fb36ed 100644 +--- a/drivers/net/usb/hso.c ++++ b/drivers/net/usb/hso.c +@@ -2886,6 +2886,11 @@ static int hso_probe(struct usb_interface *interface, + struct hso_shared_int *shared_int; + struct hso_device *tmp_dev = NULL; + ++ if (interface->cur_altsetting->desc.bInterfaceClass != 0xFF) { ++ dev_err(&interface->dev, "Not our interface\n"); ++ return -ENODEV; ++ } ++ + if_num = interface->altsetting->desc.bInterfaceNumber; + + /* Get the interface/port specification from either driver_info or from +@@ -2895,10 +2900,6 @@ static int hso_probe(struct usb_interface *interface, + else + port_spec = hso_get_config_data(interface); + +- if (interface->cur_altsetting->desc.bInterfaceClass != 0xFF) { +- dev_err(&interface->dev, "Not our interface\n"); +- return -ENODEV; +- } + /* Check if we need to switch to alt interfaces prior to port + * configuration */ + if (interface->num_altsetting > 1) +-- +1.7.9.5 + diff --git a/target/linux/generic/patches-3.9/008-hso-Fix-stack-corruption-on-some-architectures.patch b/target/linux/generic/patches-3.9/008-hso-Fix-stack-corruption-on-some-architectures.patch new file mode 100644 index 0000000000..c6da3c1c30 --- /dev/null +++ b/target/linux/generic/patches-3.9/008-hso-Fix-stack-corruption-on-some-architectures.patch @@ -0,0 +1,53 @@ +From e75dc677ff8d06ffa61bef6fee436227ae5440c6 Mon Sep 17 00:00:00 2001 +From: Daniel Gimpelevich <daniel@gimpelevich.san-francisco.ca.us> +Date: Wed, 21 Aug 2013 01:43:19 -0700 +Subject: [PATCH 2/2] hso: Fix stack corruption on some architectures + +As Sergei Shtylyov explained in the #mipslinux IRC channel: +[Mon 2013-08-19 12:28:21 PM PDT] <headless> guys, are you sure it's not "DMA off stack" case? +[Mon 2013-08-19 12:28:35 PM PDT] <headless> it's a known stack corruptor on non-coherent arches +[Mon 2013-08-19 12:31:48 PM PDT] <DonkeyHotei> headless: for usb/ehci? +[Mon 2013-08-19 12:34:11 PM PDT] <DonkeyHotei> headless: explain +[Mon 2013-08-19 12:35:38 PM PDT] <headless> usb_control_msg() (or other such func) should not use buffer on stack. DMA from/to stack is prohibited +[Mon 2013-08-19 12:35:58 PM PDT] <headless> and EHCI uses DMA on control xfers (as well as all the others) + +Signed-off-by: Daniel Gimpelevich <daniel@gimpelevich.san-francisco.ca.us> +Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> +Signed-off-by: David S. Miller <davem@davemloft.net> +--- + drivers/net/usb/hso.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/usb/hso.c b/drivers/net/usb/hso.c +index 5fb36ed..86292e6 100644 +--- a/drivers/net/usb/hso.c ++++ b/drivers/net/usb/hso.c +@@ -2816,13 +2816,16 @@ exit: + static int hso_get_config_data(struct usb_interface *interface) + { + struct usb_device *usbdev = interface_to_usbdev(interface); +- u8 config_data[17]; ++ u8 *config_data = kmalloc(17, GFP_KERNEL); + u32 if_num = interface->altsetting->desc.bInterfaceNumber; + s32 result; + ++ if (!config_data) ++ return -ENOMEM; + if (usb_control_msg(usbdev, usb_rcvctrlpipe(usbdev, 0), + 0x86, 0xC0, 0, 0, config_data, 17, + USB_CTRL_SET_TIMEOUT) != 0x11) { ++ kfree(config_data); + return -EIO; + } + +@@ -2873,6 +2876,7 @@ static int hso_get_config_data(struct usb_interface *interface) + if (config_data[16] & 0x1) + result |= HSO_INFO_CRC_BUG; + ++ kfree(config_data); + return result; + } + +-- +1.7.9.5 + |