Hello Greg,
Sorry to trouble you again.
I was waiting and observing how the FIX is applied and it looks like it will not be applied to 5.2.x (5.2.3 and 5.2.4 came out without this patch).
Personally I think it is a big mistake not to merge the fix but this is your decision.
I have to tell my users now to AVOID KERNEL 5.2 at all since it is buggy and most likely will never be fixed.
But since it is also not part of any 5.3 (right now) I'm a bit afraid I also need to put a warning to avoid 5.3 as well.
Would be nice to get an official statement like: "Linux kernel will not merge the USB fix to 5.2, maybe 5.3 will have it, but better wait for 5.4",
so I can quote this to my users.
Best Regards,
Maik Stohn
> Am 25.07.2019 um 11:27 schrieb gregkh@xxxxxxxxxxxxxxxxxxx:
>
>
> This is a note to let you know that I've just added the patch titled
>
> xhci: Fix crash if scatter gather is used with Immediate Data
>
> to my usb git tree which can be found at
> git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git
> in the usb-linus branch.
>
> The patch will show up in the next release of the linux-next tree
> (usually sometime within the next 24 hours during the week.)
>
> The patch will hopefully also be merged in Linus's tree for the
> next -rc kernel release.
>
> If you have any questions about this process, please let me know.
>
>
> From d39b5bad8658d6d94cb2d98a44a7e159db4f5030 Mon Sep 17 00:00:00 2001
> From: Mathias Nyman <mathias.nyman@xxxxxxxxxxxxxxx>
> Date: Thu, 25 Jul 2019 11:54:21 +0300
> Subject: xhci: Fix crash if scatter gather is used with Immediate Data
> Transfer (IDT).
>
> A second regression was found in the immediate data transfer (IDT)
> support which was added to 5.2 kernel
>
> IDT is used to transfer small amounts of data (up to 8 bytes) in the
> field normally used for data dma address, thus avoiding dma mapping.
>
> If the data was not already dma mapped, then IDT support assumed data was
> in urb->transfer_buffer, and did not take into accound that even
> small amounts of data (8 bytes) can be in a scatterlist instead.
>
> This caused a NULL pointer dereference when sg_dma_len() was used
> with non-dma mapped data.
>
> Solve this by not using IDT if scatter gather buffer list is used.
>
> Fixes: 33e39350ebd2 ("usb: xhci: add Immediate Data Transfer support")
> Cc: <stable@xxxxxxxxxxxxxxx> # v5.2
> Reported-by: Maik Stohn <maik.stohn@xxxxxxxxxxxx>
> Tested-by: Maik Stohn <maik.stohn@xxxxxxxxxxxx>
> CC: Nicolas Saenz Julienne <nsaenzjulienne@xxxxxxx>
> Signed-off-by: Mathias Nyman <mathias.nyman@xxxxxxxxxxxxxxx>
> Link: https://lore.kernel.org/r/1564044861-1445-1-git-send-email-mathias.nyman@xxxxxxxxxxxxxxx
> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
> ---
> drivers/usb/host/xhci.h | 3 ++-
> 1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h
> index 7a264962a1a9..f5c41448d067 100644
> --- a/drivers/usb/host/xhci.h
> +++ b/drivers/usb/host/xhci.h
> @@ -2175,7 +2175,8 @@ static inline bool xhci_urb_suitable_for_idt(struct urb *urb)
> if (!usb_endpoint_xfer_isoc(&urb->ep->desc) && usb_urb_dir_out(urb) &&
> usb_endpoint_maxp(&urb->ep->desc) >= TRB_IDT_MAX_SIZE &&
> urb->transfer_buffer_length <= TRB_IDT_MAX_SIZE &&
> - !(urb->transfer_flags & URB_NO_TRANSFER_DMA_MAP))
> + !(urb->transfer_flags & URB_NO_TRANSFER_DMA_MAP) &&
> + !urb->num_sgs)
> return true;
>
> return false;
> --
> 2.22.0
>
>
Attachment:
smime.p7s
Description: S/MIME cryptographic signature
