On Mon, 2014-02-24 at 15:44 -0500, Alan Stern wrote:
> On Mon, 24 Feb 2014, Dan Williams wrote:
>
> > Save someone else the debug cycles of figuring out why a driver's
> > transfer request is failing or causing undefined system behavior.
> > Buffers submitted for dma must come from GFP allocated / DMA-able
> > memory.
> >
> > Return -EAGAIN matching the return value for dma_mapping_error() cases.
> >
> > Cc: Alan Stern <stern@xxxxxxxxxxxxxxxxxxx>
> > Cc: Sarah Sharp <sarah.a.sharp@xxxxxxxxxxxxxxx>
> > Cc: Mathias Nyman <mathias.nyman@xxxxxxxxxxxxxxx>
> > Signed-off-by: Dan Williams <dan.j.williams@xxxxxxxxx>
> > ---
> > drivers/usb/core/hcd.c | 3 +++
> > 1 files changed, 3 insertions(+), 0 deletions(-)
> >
> > diff --git a/drivers/usb/core/hcd.c b/drivers/usb/core/hcd.c
> > index 2518c3250750..ff7cd489f55d 100644
> > --- a/drivers/usb/core/hcd.c
> > +++ b/drivers/usb/core/hcd.c
> > @@ -1502,6 +1502,9 @@ int usb_hcd_map_urb_for_dma(struct usb_hcd *hcd, struct urb *urb,
> > ret = -EAGAIN;
> > else
> > urb->transfer_flags |= URB_DMA_MAP_PAGE;
> > + } else if (is_vmalloc_addr(urb->transfer_buffer)) {
> > + WARN_ONCE(1, "transfer buffer not dma capable\n");
> > + return -EAGAIN;
> > } else {
> > urb->transfer_dma = dma_map_single(
> > hcd->self.controller,
> >
>
> You mustn't just return -EAGAIN. Set ret = -EAGAIN and fall through to
> the error-handling pathway.
Alan, I'm simply trying to trade one undefined behavior for another ;-).
Good catch.
Although the result would be the same in this case, it's something
subtle for someone to trip over later.
Hmm, this check above also short-circuits the error fall-through:
/* We don't support sg for isoc transfers ! */
if (usb_endpoint_xfer_isoc(&urb->ep->desc)) {
WARN_ON(1);
return -EINVAL;
}
8<------------
Subject: usb: catch attempts to submit urbs with a vmalloc'd transfer buffer
From: Dan Williams <dan.j.williams@xxxxxxxxx>
Save someone else the debug cycles of figuring out why a driver's
transfer request is failing or causing undefined system behavior.
Buffers submitted for dma must come from GFP allocated / DMA-able
memory.
Return -EAGAIN matching the return value for dma_mapping_error() cases.
Cc: Alan Stern <stern@xxxxxxxxxxxxxxxxxxx>
Cc: Sarah Sharp <sarah.a.sharp@xxxxxxxxxxxxxxx>
Cc: Mathias Nyman <mathias.nyman@xxxxxxxxxxxxxxx>
Signed-off-by: Dan Williams <dan.j.williams@xxxxxxxxx>
---
drivers/usb/core/hcd.c | 3 +++
1 files changed, 3 insertions(+), 0 deletions(-)
diff --git a/drivers/usb/core/hcd.c b/drivers/usb/core/hcd.c
index 2518c3250750..a8a8cc94b6e3 100644
--- a/drivers/usb/core/hcd.c
+++ b/drivers/usb/core/hcd.c
@@ -1502,6 +1502,9 @@ int usb_hcd_map_urb_for_dma(struct usb_hcd *hcd, struct urb *urb,
ret = -EAGAIN;
else
urb->transfer_flags |= URB_DMA_MAP_PAGE;
+ } else if (is_vmalloc_addr(urb->transfer_buffer)) {
+ WARN_ONCE(1, "transfer buffer not dma capable\n");
+ ret = -EAGAIN;
} else {
urb->transfer_dma = dma_map_single(
hcd->self.controller,
--
To unsubscribe from this list: send the line "unsubscribe linux-usb" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
