Skip to contentSkip to conversation

Fix stack corruption on some architectures

PATCH In review Daniel Gimpelevich 4 participants 6 messages Aug 19, 2013 – Aug 21, 2013

Subsystems (4)
Networking Network drivers USB networking drivers Hso 3G modem driver
lore
Share & tools
lore

Daniel Gimpelevich

author
#0 lore raw

PATCH 1/1 Fix stack corruption on some architectures

There is no need to get an interface specification if we know it's the wrong one; trivial change. The big thing, though, was explained in the #mipslinux IRC channel:

[Mon 2013-08-19 12:28:21 PM PDT] <headless> guys, are you sure it's not "DMA off stack" case?
[Mon 2013-08-19 12:28:35 PM PDT] <headless> it's a known stack corruptor on non-coherent arches
[Mon 2013-08-19 12:31:48 PM PDT] <DonkeyHotei> headless: for usb/ehci?
[Mon 2013-08-19 12:34:11 PM PDT] <DonkeyHotei> headless: explain
[Mon 2013-08-19 12:35:38 PM PDT] <headless> usb_control_msg() (or other such func) should not use buffer on stack. DMA from/to stack is prohibited
[Mon 2013-08-19 12:35:58 PM PDT] <headless> and EHCI uses DMA on control xfers (as well as all the others)
Signed-off-by Daniel Gimpelevich <[email protected]>
---
 drivers/net/usb/hso.c |   15 ++++++++++-----
 1 file changed, 10 insertions(+), 5 deletions(-)
drivers/net/usb/hso.c +10 -5
index cba1d46..86292e6 100644
@@ -2816,13 +2816,16 @@ exit:
 static int hso_get_config_data(struct usb_interface *interface)
 {
 	struct usb_device *usbdev = interface_to_usbdev(interface);
-	u8 config_data[17];
+	u8 *config_data = kmalloc(17, GFP_KERNEL);
 	u32 if_num = interface->altsetting->desc.bInterfaceNumber;
 	s32 result;
 
+	if (!config_data)
+		return -ENOMEM;
 	if (usb_control_msg(usbdev, usb_rcvctrlpipe(usbdev, 0),
 			    0x86, 0xC0, 0, 0, config_data, 17,
 			    USB_CTRL_SET_TIMEOUT) != 0x11) {
+		kfree(config_data);
 		return -EIO;
 	}
 

@@ -2873,6 +2876,7 @@ static int hso_get_config_data(struct usb_interface *interface)
 	if (config_data[16] & 0x1)
 		result |= HSO_INFO_CRC_BUG;
 
+	kfree(config_data);
 	return result;
 }
 

@@ -2886,6 +2890,11 @@ static int hso_probe(struct usb_interface *interface,
 	struct hso_shared_int *shared_int;
 	struct hso_device *tmp_dev = NULL;
 
+	if (interface->cur_altsetting->desc.bInterfaceClass != 0xFF) {
+		dev_err(&interface->dev, "Not our interface\n");
+		return -ENODEV;
+	}
+
 	if_num = interface->altsetting->desc.bInterfaceNumber;
 
 	/* Get the interface/port specification from either driver_info or from

@@ -2895,10 +2904,6 @@ static int hso_probe(struct usb_interface *interface,
 	else
 		port_spec = hso_get_config_data(interface);
 
-	if (interface->cur_altsetting->desc.bInterfaceClass != 0xFF) {
-		dev_err(&interface->dev, "Not our interface\n");
-		return -ENODEV;
-	}
 	/* Check if we need to switch to alt interfaces prior to port
 	 * configuration */
 	if (interface->num_altsetting > 1)
Signature · 1 line
1.7.9.5
Acked-by on v1 1/1
#1 lore raw
Quoted 11 lines · Daniel Gimpelevich

There is no need to get an interface specification if we know it's the wrong one; trivial change. The big thing, though, was explained in the #mipslinux IRC channel:

[Mon 2013-08-19 12:28:21 PM PDT] <headless> guys, are you sure it's not "DMA off stack" case?
[Mon 2013-08-19 12:28:35 PM PDT] <headless> it's a known stack corruptor on non-coherent arches
[Mon 2013-08-19 12:31:48 PM PDT] <DonkeyHotei> headless: for usb/ehci?
[Mon 2013-08-19 12:34:11 PM PDT] <DonkeyHotei> headless: explain
[Mon 2013-08-19 12:35:38 PM PDT] <headless> usb_control_msg() (or other such func) should not use buffer on stack. DMA from/to stack is prohibited
[Mon 2013-08-19 12:35:58 PM PDT] <headless> and EHCI uses DMA on control xfers (as well as all the others)
Signed-off-by Daniel Gimpelevich <[email protected]>
Acked-by Greg Kroah-Hartman <[email protected]>
#2 lore raw
In reply to Daniel Gimpelevich

Hello.

Quoted 2 lines · Daniel Gimpelevich

There is no need to get an interface specification if we know it's the wrong one; trivial change.

Is it related to stack corruption? If not, it's asking to be in a separate
patch.

Quoted 8 lines

The big thing, though, was explained in the
#mipslinux IRC channel:

[Mon 2013-08-19 12:28:21 PM PDT] <headless> guys, are you sure it's not "DMA off stack" case?
[Mon 2013-08-19 12:28:35 PM PDT] <headless> it's a known stack corruptor on non-coherent arches
[Mon 2013-08-19 12:31:48 PM PDT] <DonkeyHotei> headless: for usb/ehci?
[Mon 2013-08-19 12:34:11 PM PDT] <DonkeyHotei> headless: explain
[Mon 2013-08-19 12:35:38 PM PDT] <headless> usb_control_msg() (or other such func) should not use buffer on stack. DMA from/to stack is prohibited
[Mon 2013-08-19 12:35:58 PM PDT] <headless> and EHCI uses DMA on control xfers (as well as all the others)

That headless was me. :-)

Quoted 1 line
Signed-off-by Daniel Gimpelevich <[email protected]>

WBR, Sergei

author
#3 lore raw
Quoted 9 lines · Sergei Shtylyov

Hello.

Quoted 2 lines · Daniel Gimpelevich

There is no need to get an interface specification if we know it's the wrong one; trivial change.

Is it related to stack corruption? If not, it's asking to be in a separate
patch.

Perhaps, but I'll leave that up to the maintainer(s). You should be credited as co-author of the patch.

maintainer
#4 lore raw
In reply to Daniel Gimpelevich

Please submit this with a more appropriate subject line.

After '[PATCH] ' there should be a subsystem or driver name prefix, followed up a semicolon. Here it could be "hso: ", so something like:

[PATCH] hso: Fix stack corruption on some architectures.
--
To unsubscribe from this list: send the line "unsubscribe linux-usb" in the body of a message to [email protected] More majordomo info at http://vger.kernel.org/majordomo-info.html

author
#5 lore raw
Quoted 7 lines · David Miller

Please submit this with a more appropriate subject line.

After '[PATCH] ' there should be a subsystem or driver name prefix, followed up a semicolon. Here it could be "hso: ", so something like:

[PATCH] hso: Fix stack corruption on some architectures.

Resent.