提交 192bf9de 编写于 作者: P Pavel Skripkin 提交者: Zheng Zengkai

can: mcba_usb_start(): add missing urb->transfer_dma initialization

stable inclusion
from stable-5.10.56
commit a6ebfbdaca3da6ba66c68fbe6636217bcb98b06a
bugzilla: 176004 https://gitee.com/openeuler/kernel/issues/I4DYZ4

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=a6ebfbdaca3da6ba66c68fbe6636217bcb98b06a

--------------------------------

commit fc43fb69 upstream.

Yasushi reported, that his Microchip CAN Analyzer stopped working
since commit 91c02557 ("can: mcba_usb: fix memory leak in
mcba_usb"). The problem was in missing urb->transfer_dma
initialization.

In my previous patch to this driver I refactored mcba_usb_start() code
to avoid leaking usb coherent buffers. To archive it, I passed local
stack variable to usb_alloc_coherent() and then saved it to private
array to correctly free all coherent buffers on ->close() call. But I
forgot to initialize urb->transfer_dma with variable passed to
usb_alloc_coherent().

All of this was causing device to not work, since dma addr 0 is not
valid and following log can be found on bug report page, which points
exactly to problem described above.

| DMAR: [DMA Write] Request device [00:14.0] PASID ffffffff fault addr 0 [fault reason 05] PTE Write access is not set

Fixes: 91c02557 ("can: mcba_usb: fix memory leak in mcba_usb")
Link: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=990850
Link: https://lore.kernel.org/r/20210725103630.23864-1-paskripkin@gmail.com
Cc: linux-stable <stable@vger.kernel.org>
Reported-by: NYasushi SHOJI <yasushi.shoji@gmail.com>
Signed-off-by: NPavel Skripkin <paskripkin@gmail.com>
Tested-by: NYasushi SHOJI <yashi@spacecubics.com>
[mkl: fixed typos in commit message - thanks Yasushi SHOJI]
Signed-off-by: NMarc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: NChen Jun <chenjun102@huawei.com>
Acked-by: NWeilong Chen <chenweilong@huawei.com>
Signed-off-by: NChen Jun <chenjun102@huawei.com>
Signed-off-by: NZheng Zengkai <zhengzengkai@huawei.com>
上级 a455a2e3
...@@ -653,6 +653,8 @@ static int mcba_usb_start(struct mcba_priv *priv) ...@@ -653,6 +653,8 @@ static int mcba_usb_start(struct mcba_priv *priv)
break; break;
} }
urb->transfer_dma = buf_dma;
usb_fill_bulk_urb(urb, priv->udev, usb_fill_bulk_urb(urb, priv->udev,
usb_rcvbulkpipe(priv->udev, MCBA_USB_EP_IN), usb_rcvbulkpipe(priv->udev, MCBA_USB_EP_IN),
buf, MCBA_USB_RX_BUFF_SIZE, buf, MCBA_USB_RX_BUFF_SIZE,
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册