Skip to content

Commit

Permalink
at76c50x-usb: Don't perform DMA from stack memory
Browse files Browse the repository at this point in the history 
Loading the driver with DMA debugging enabled makes the kernel to complain
about the ehci driver trying to perform DMA from memory from the stack.

[ 9848.229514] WARNING: CPU: 1 PID: 627 at lib/dma-debug.c:1153 check_for_stack+0xa4/0xf0()
[ 9848.237678] ehci-pci 0000:00:04.1: DMA-API: device driver maps memory fromstack [addr=ffff88006c80da01]

This is due to at76c50x-usb driver passing buffers allocated on the stack to
the USB layer, that attempts DMA. This occurs is several places.

This patch fixes the problem by allocating those buffers via kmalloc.

Since this adds some kfree() before leaving a couple of functions, I caught the
occasion to clean-up the exit path on error.

Signed-off-by: Andrea Merello <andrea.merello@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
  • Loading branch information
Andrea Merello authored and John W. Linville committed May 29, 2014
1 parent 7dd74f5 commit 174beab
Showing 1 changed file with 56 additions and 31 deletions.
87 changes: 56 additions & 31 deletions drivers/net/wireless/at76c50x-usb.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -365,15 +365,15 @@ static inline unsigned long at76_get_timeout(struct dfu_status *s)
static int at76_usbdfu_download(struct usb_device *udev, u8 *buf, u32 size,
int manifest_sync_timeout)
{
u8 *block;
struct dfu_status dfu_stat_buf;
int ret = 0;
int need_dfu_state = 1;
int is_done = 0;
u8 dfu_state = 0;
u32 dfu_timeout = 0;
int bsize = 0;
int blockno = 0;
struct dfu_status *dfu_stat_buf = NULL;
u8 *dfu_state = NULL;
u8 *block = NULL;

at76_dbg(DBG_DFU, "%s( %p, %u, %d)", __func__, buf, size,
manifest_sync_timeout);
Expand All @@ -383,13 +383,28 @@ static int at76_usbdfu_download(struct usb_device *udev, u8 *buf, u32 size,
return -EINVAL;
}

dfu_stat_buf = kmalloc(sizeof(struct dfu_status), GFP_KERNEL);
if (!dfu_stat_buf) {
ret = -ENOMEM;
goto exit;
}

block = kmalloc(FW_BLOCK_SIZE, GFP_KERNEL);
if (!block)
return -ENOMEM;
if (!block) {
ret = -ENOMEM;
goto exit;
}

dfu_state = kmalloc(sizeof(u8), GFP_KERNEL);
if (!dfu_state) {
ret = -ENOMEM;
goto exit;
}
*dfu_state = 0;

do {
if (need_dfu_state) {
ret = at76_dfu_get_state(udev, &dfu_state);
ret = at76_dfu_get_state(udev, dfu_state);
if (ret < 0) {
dev_err(&udev->dev,
"cannot get DFU state: %d\n", ret);
Expand All @@ -398,13 +413,13 @@ static int at76_usbdfu_download(struct usb_device *udev, u8 *buf, u32 size,
need_dfu_state = 0;
}

switch (dfu_state) {
switch (*dfu_state) {
case STATE_DFU_DOWNLOAD_SYNC:
at76_dbg(DBG_DFU, "STATE_DFU_DOWNLOAD_SYNC");
ret = at76_dfu_get_status(udev, &dfu_stat_buf);
ret = at76_dfu_get_status(udev, dfu_stat_buf);
if (ret >= 0) {
dfu_state = dfu_stat_buf.state;
dfu_timeout = at76_get_timeout(&dfu_stat_buf);
*dfu_state = dfu_stat_buf->state;
dfu_timeout = at76_get_timeout(dfu_stat_buf);
need_dfu_state = 0;
} else
dev_err(&udev->dev,
Expand Down Expand Up @@ -447,12 +462,12 @@ static int at76_usbdfu_download(struct usb_device *udev, u8 *buf, u32 size,
case STATE_DFU_MANIFEST_SYNC:
at76_dbg(DBG_DFU, "STATE_DFU_MANIFEST_SYNC");

ret = at76_dfu_get_status(udev, &dfu_stat_buf);
ret = at76_dfu_get_status(udev, dfu_stat_buf);
if (ret < 0)
break;

dfu_state = dfu_stat_buf.state;
dfu_timeout = at76_get_timeout(&dfu_stat_buf);
*dfu_state = dfu_stat_buf->state;
dfu_timeout = at76_get_timeout(dfu_stat_buf);
need_dfu_state = 0;

/* override the timeout from the status response,
Expand Down Expand Up @@ -484,14 +499,17 @@ static int at76_usbdfu_download(struct usb_device *udev, u8 *buf, u32 size,
break;

default:
at76_dbg(DBG_DFU, "DFU UNKNOWN STATE (%d)", dfu_state);
at76_dbg(DBG_DFU, "DFU UNKNOWN STATE (%d)", *dfu_state);
ret = -EINVAL;
break;
}
} while (!is_done && (ret >= 0));

exit:
kfree(dfu_state);
kfree(block);
kfree(dfu_stat_buf);

if (ret >= 0)
ret = 0;

Expand Down Expand Up @@ -1277,6 +1295,7 @@ static int at76_load_external_fw(struct usb_device *udev, struct fwentry *fwe)
dev_err(&udev->dev,
"loading %dth firmware block failed: %d\n",
blockno, ret);
ret = -EIO;
goto exit;
}
buf += bsize;
Expand Down Expand Up @@ -2330,16 +2349,22 @@ static int at76_probe(struct usb_interface *interface,
struct usb_device *udev;
int op_mode;
int need_ext_fw = 0;
struct mib_fw_version fwv;
struct mib_fw_version *fwv = NULL;
int board_type = (int)id->driver_info;

udev = usb_get_dev(interface_to_usbdev(interface));

fwv = kmalloc(sizeof(*fwv), GFP_KERNEL);
if (!fwv) {
ret = -ENOMEM;
goto exit;
}

/* Load firmware into kernel memory */
fwe = at76_load_firmware(udev, board_type);
if (!fwe) {
ret = -ENOENT;
goto error;
goto exit;
}

op_mode = at76_get_op_mode(udev);
Expand All @@ -2353,7 +2378,7 @@ static int at76_probe(struct usb_interface *interface,
dev_err(&interface->dev,
"cannot handle a device in HW_CONFIG_MODE\n");
ret = -EBUSY;
goto error;
goto exit;
}

if (op_mode != OPMODE_NORMAL_NIC_WITH_FLASH
Expand All @@ -2366,10 +2391,10 @@ static int at76_probe(struct usb_interface *interface,
dev_err(&interface->dev,
"error %d downloading internal firmware\n",
ret);
goto error;
goto exit;
}
usb_put_dev(udev);
return ret;
goto exit;
}

/* Internal firmware already inside the device. Get firmware
Expand All @@ -2382,8 +2407,8 @@ static int at76_probe(struct usb_interface *interface,
* query the device for the fw version */
if ((fwe->fw_version.major > 0 || fwe->fw_version.minor >= 100)
|| (op_mode == OPMODE_NORMAL_NIC_WITH_FLASH)) {
ret = at76_get_mib(udev, MIB_FW_VERSION, &fwv, sizeof(fwv));
if (ret < 0 || (fwv.major | fwv.minor) == 0)
ret = at76_get_mib(udev, MIB_FW_VERSION, fwv, sizeof(*fwv));
if (ret < 0 || (fwv->major | fwv->minor) == 0)
need_ext_fw = 1;
} else
/* No way to check firmware version, reload to be sure */
Expand All @@ -2394,37 +2419,37 @@ static int at76_probe(struct usb_interface *interface,
"downloading external firmware\n");

ret = at76_load_external_fw(udev, fwe);
if (ret)
goto error;
if (ret < 0)
goto exit;

/* Re-check firmware version */
ret = at76_get_mib(udev, MIB_FW_VERSION, &fwv, sizeof(fwv));
ret = at76_get_mib(udev, MIB_FW_VERSION, fwv, sizeof(*fwv));
if (ret < 0) {
dev_err(&interface->dev,
"error %d getting firmware version\n", ret);
goto error;
goto exit;
}
}

priv = at76_alloc_new_device(udev);
if (!priv) {
ret = -ENOMEM;
goto error;
goto exit;
}

usb_set_intfdata(interface, priv);

memcpy(&priv->fw_version, &fwv, sizeof(struct mib_fw_version));
memcpy(&priv->fw_version, fwv, sizeof(struct mib_fw_version));
priv->board_type = board_type;

ret = at76_init_new_device(priv, interface);
if (ret < 0)
at76_delete_device(priv);

return ret;

error:
usb_put_dev(udev);
exit:
kfree(fwv);
if (ret < 0)
usb_put_dev(udev);
return ret;
}

Expand Down

0 comments on commit 174beab

Please sign in to comment.