linux/drivers/usb
Lars-Peter Clausen aa8141daf0 usb: gadget: ffs: Execute copy_to_user() with USER_DS set
[ Upstream commit 4058ebf33c ]

When using a AIO read() operation on the function FS gadget driver a URB is
submitted asynchronously and on URB completion the received data is copied
to the userspace buffer associated with the read operation.

This is done from a kernel worker thread invoking copy_to_user() (through
copy_to_iter()). And while the user space process memory is made available
to the kernel thread using use_mm(), some architecture require in addition
to this that the operation runs with USER_DS set. Otherwise the userspace
memory access will fail.

For example on ARM64 with Privileged Access Never (PAN) and User Access
Override (UAO) enabled the following crash occurs.

	Internal error: Accessing user space memory with fs=KERNEL_DS: 9600004f [#1] SMP
	Modules linked in:
	CPU: 2 PID: 1636 Comm: kworker/2:1 Not tainted 4.9.0-04081-g8ab2dfb-dirty #487
	Hardware name: ZynqMP ZCU102 Rev1.0 (DT)
	Workqueue: events ffs_user_copy_worker
	task: ffffffc87afc8080 task.stack: ffffffc87a00c000
	PC is at __arch_copy_to_user+0x190/0x220
	LR is at copy_to_iter+0x78/0x3c8
	[...]
	[<ffffff800847b790>] __arch_copy_to_user+0x190/0x220
	[<ffffff80086f25d8>] ffs_user_copy_worker+0x70/0x130
	[<ffffff80080b8c64>] process_one_work+0x1dc/0x460
	[<ffffff80080b8f38>] worker_thread+0x50/0x4b0
	[<ffffff80080bf5a0>] kthread+0xd8/0xf0
	[<ffffff8008083680>] ret_from_fork+0x10/0x50

Address this by placing a set_fs(USER_DS) before of the copy operation
and revert it again once the copy operation has finished.

This patch is analogous to commit d7ffde35e3 ("vhost: use USER_DS in
vhost_worker thread") which addresses the same underlying issue.

Signed-off-by: Lars-Peter Clausen <lars@metafoo.de>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-05-30 07:49:12 +02:00
..
atm USB: atm: cxacru: fix blank line after declaration 2015-07-22 14:55:22 -07:00
c67x00 c67x00-hcd: use USB_DT_HUB 2015-04-03 19:03:16 +02:00
chipidea usb: chipidea: properly handle host or gadget initialization failure 2018-04-13 19:50:07 +02:00
class CDC-ACM: apply quirk for card reader 2018-02-03 17:04:30 +01:00
common usb: define USB_SPEED_SUPER_PLUS speed for SuperSpeedPlus USB3.1 devices 2016-09-07 08:32:39 +02:00
core USB: Accept bulk endpoints with 1024-byte maxpacket 2018-05-16 10:06:49 +02:00
dwc2 usb: dwc2: Fix interval type issue 2018-05-30 07:49:12 +02:00
dwc3 usb: dwc3: Update DWC_usb31 GTXFIFOSIZ reg fields 2018-05-30 07:49:11 +02:00
early
gadget usb: gadget: ffs: Execute copy_to_user() with USER_DS set 2018-05-30 07:49:12 +02:00
host xhci: zero usb device slot_id member when disabling and freeing a xhci slot 2018-05-30 07:49:12 +02:00
image scsi: Do not set cmd_per_lun to 1 in the host template 2015-05-31 18:06:28 -07:00
isp1760 usb: isp1760: udc: add ep capabilities support 2015-08-04 12:26:55 -05:00
misc usb: ldusb: add PIDs for new CASSY devices supported by this driver 2018-02-28 10:17:23 +01:00
mon usb: usbmon: Read text within supplied buffer size 2018-03-18 11:17:53 +01:00
musb usb: musb: call pm_runtime_{get,put}_sync before reading vbus registers 2018-05-30 07:49:03 +02:00
phy usb: phy: msm add regulator dependency 2018-02-25 11:03:51 +01:00
renesas_usbhs usb: renesas_usbhs: missed the "running" flag in usb_dmac with rx path 2018-02-28 10:17:23 +01:00
serial USB: serial: option: adding support for ublox R410M 2018-05-16 10:06:49 +02:00
storage USB: ene_usb6250: fix SCSI residue overwriting 2018-04-13 19:50:07 +02:00
usbip usbip: usbip_host: fix bad unlock balance during stub_probe() 2018-05-26 08:48:52 +02:00
wusbcore USB: wusbcore: fix NULL-deref at probe 2017-03-30 09:35:17 +02:00
Kconfig usb: isp1760: Move driver from drivers/usb/host/ to drivers/usb/isp1760/ 2015-01-27 09:39:38 -06:00
Makefile usb-host: Remove fusbh200 driver 2015-10-16 23:44:33 -07:00
README
usb-skeleton.c

To understand all the Linux-USB framework, you'll use these resources:

    * This source code.  This is necessarily an evolving work, and
      includes kerneldoc that should help you get a current overview.
      ("make pdfdocs", and then look at "usb.pdf" for host side and
      "gadget.pdf" for peripheral side.)  Also, Documentation/usb has
      more information.

    * The USB 2.0 specification (from www.usb.org), with supplements
      such as those for USB OTG and the various device classes.
      The USB specification has a good overview chapter, and USB
      peripherals conform to the widely known "Chapter 9".

    * Chip specifications for USB controllers.  Examples include
      host controllers (on PCs, servers, and more); peripheral
      controllers (in devices with Linux firmware, like printers or
      cell phones); and hard-wired peripherals like Ethernet adapters.

    * Specifications for other protocols implemented by USB peripheral
      functions.  Some are vendor-specific; others are vendor-neutral
      but just standardized outside of the www.usb.org team.

Here is a list of what each subdirectory here is, and what is contained in
them.

core/		- This is for the core USB host code, including the
		  usbfs files and the hub class driver ("hub_wq").

host/		- This is for USB host controller drivers.  This
		  includes UHCI, OHCI, EHCI, and others that might
		  be used with more specialized "embedded" systems.

gadget/		- This is for USB peripheral controller drivers and
		  the various gadget drivers which talk to them.


Individual USB driver directories.  A new driver should be added to the
first subdirectory in the list below that it fits into.

image/		- This is for still image drivers, like scanners or
		  digital cameras.
../input/	- This is for any driver that uses the input subsystem,
		  like keyboard, mice, touchscreens, tablets, etc.
../media/	- This is for multimedia drivers, like video cameras,
		  radios, and any other drivers that talk to the v4l
		  subsystem.
../net/		- This is for network drivers.
serial/		- This is for USB to serial drivers.
storage/	- This is for USB mass-storage drivers.
class/		- This is for all USB device drivers that do not fit
		  into any of the above categories, and work for a range
		  of USB Class specified devices. 
misc/		- This is for all USB device drivers that do not fit
		  into any of the above categories.