mirror of
https://github.com/torvalds/linux.git
synced 2026-10-28 09:35:02 +01:00
ff44dfb03a
When a TD reaches a link TRB with data that is not aligned to the
endpoint's wMaxPacketSize, xhci_align_td() stages the unalignable tail
through the bounce buffer of the ring segment holding that link TRB.
xhci_unmap_td_bounce_buffer() later unmaps it and, for IN transfers,
copies the data back into the URB's buffer.
The enqueue path records the segment that was bounced in td->bounce_seg,
under the assumption that a TD never spans more than two ring segments.
That assumption does not hold: a TD large enough to span three or more
segments crosses several link TRBs and can be bounced at each of them.
Only the last one survives in td->bounce_seg, so every earlier bounce
buffer is neither copied back nor DMA unmapped.
The URB still completes with actual_length equal to the requested length
and no error, so the transfer looks successful while a wMaxPacketSize
sized hole in the destination buffer silently keeps its previous
contents. It also leaks a DMA mapping per dropped bounce.
Any sufficiently large and fragmented bulk transfer can hit this. It was
found with a USB mass storage device behind xHCI backing a dm-verity
target with 512 byte hash blocks, where the stale data is detected rather
than silently consumed. The device enumerates as SuperSpeed, so
wMaxPacketSize is 1024, while dm-bufio issues one 512 byte bio per hash
block. verity_prefetch_io() makes the block layer merge hundreds of them
into a single request of up to 512 scatterlist entries of 512 bytes each.
At 256 TRBs per ring segment such a TD spans three segments, and every
segment boundary falls on an odd multiple of 512, i.e. unaligned to
wMaxPacketSize. dm-bufio then caches a hash block holding stale data and
dm-verity declares the metadata block corrupted:
device-mapper: verity: 8:2: metadata block 10850 is corrupted
A reproducer running this under qemu is available at
https://github.com/baloo/xhci-verity
The bounce state (bounce_buf, bounce_dma, bounce_len, bounce_offs)
already lives on the ring segment, so there is nothing extra to track.
Keep recording the last bounced segment in td->bounce_seg and, on
completion, walk the segments from td->start_seg up to it, unmapping
every segment that still has a pending bounce.
Stopping at td->bounce_seg rather than td->end_seg matters: a bounce
implies the TD continues past that segment's link TRB, so bounce_seg is
always strictly before end_seg, and a later TD may already have started
in end_seg and been bounced there. Walking that far would copy a foreign
bounce buffer into this URB and unmap it twice. It also keeps the walk
correct if a TD ever wraps the whole ring so that end_seg == start_seg.
[mn: Add ring->num_segs check to prevent unlikely infinite for loop.]
Fixes:
|
||
|---|---|---|
| .. | ||
| bcma-hcd.c | ||
| ehci-atmel.c | ||
| ehci-brcm.c | ||
| ehci-dbg.c | ||
| ehci-exynos.c | ||
| ehci-fsl.c | ||
| ehci-fsl.h | ||
| ehci-grlib.c | ||
| ehci-hcd.c | ||
| ehci-hub.c | ||
| ehci-mem.c | ||
| ehci-mv.c | ||
| ehci-npcm7xx.c | ||
| ehci-omap.c | ||
| ehci-orion.c | ||
| ehci-pci.c | ||
| ehci-platform.c | ||
| ehci-ppc-of.c | ||
| ehci-ps3.c | ||
| ehci-q.c | ||
| ehci-sched.c | ||
| ehci-sh.c | ||
| ehci-spear.c | ||
| ehci-st.c | ||
| ehci-sysfs.c | ||
| ehci-timer.c | ||
| ehci-xilinx-of.c | ||
| ehci.h | ||
| fhci-dbg.c | ||
| fhci-hcd.c | ||
| fhci-hub.c | ||
| fhci-mem.c | ||
| fhci-q.c | ||
| fhci-sched.c | ||
| fhci-tds.c | ||
| fhci.h | ||
| fsl-mph-dr-of.c | ||
| isp116x-hcd.c | ||
| isp116x.h | ||
| Kconfig | ||
| Makefile | ||
| max3421-hcd.c | ||
| octeon-hcd.c | ||
| octeon-hcd.h | ||
| ohci-at91.c | ||
| ohci-da8xx.c | ||
| ohci-dbg.c | ||
| ohci-exynos.c | ||
| ohci-hcd.c | ||
| ohci-hub.c | ||
| ohci-mem.c | ||
| ohci-nxp.c | ||
| ohci-omap.c | ||
| ohci-pci.c | ||
| ohci-platform.c | ||
| ohci-ppc-of.c | ||
| ohci-ps3.c | ||
| ohci-pxa27x.c | ||
| ohci-q.c | ||
| ohci-s3c2410.c | ||
| ohci-sa1111.c | ||
| ohci-sm501.c | ||
| ohci-spear.c | ||
| ohci-st.c | ||
| ohci.h | ||
| oxu210hp-hcd.c | ||
| pci-quirks.c | ||
| pci-quirks.h | ||
| r8a66597-hcd.c | ||
| r8a66597.h | ||
| sl811_cs.c | ||
| sl811-hcd.c | ||
| sl811.h | ||
| ssb-hcd.c | ||
| uhci-debug.c | ||
| uhci-grlib.c | ||
| uhci-hcd.c | ||
| uhci-hcd.h | ||
| uhci-hub.c | ||
| uhci-pci.c | ||
| uhci-platform.c | ||
| uhci-q.c | ||
| xen-hcd.c | ||
| xhci-caps.h | ||
| xhci-dbg.c | ||
| xhci-dbgcap.c | ||
| xhci-dbgcap.h | ||
| xhci-dbgtty.c | ||
| xhci-debugfs.c | ||
| xhci-debugfs.h | ||
| xhci-ext-caps.c | ||
| xhci-ext-caps.h | ||
| xhci-histb.c | ||
| xhci-hub.c | ||
| xhci-mem.c | ||
| xhci-mtk-sch.c | ||
| xhci-mtk.c | ||
| xhci-mtk.h | ||
| xhci-mvebu.c | ||
| xhci-mvebu.h | ||
| xhci-pci-prom21.c | ||
| xhci-pci-renesas.c | ||
| xhci-pci.c | ||
| xhci-pci.h | ||
| xhci-plat.c | ||
| xhci-plat.h | ||
| xhci-port.h | ||
| xhci-rcar-regs.h | ||
| xhci-rcar.c | ||
| xhci-ring.c | ||
| xhci-rzg3e-regs.h | ||
| xhci-rzv2m.c | ||
| xhci-rzv2m.h | ||
| xhci-sideband.c | ||
| xhci-tegra.c | ||
| xhci-trace.c | ||
| xhci-trace.h | ||
| xhci.c | ||
| xhci.h | ||