Messages in this thread | | | Date | Mon, 9 Mar 2020 11:16:11 -0500 | From | Bin Liu <> | Subject | Re: [PATCH v2] usb: musb: fix crash with highmen PIO and usbmon |
| |
On Mon, Mar 09, 2020 at 03:26:53PM +0000, Mans Rullgard wrote: > When handling a PIO bulk transfer with highmem buffer, a temporary > mapping is assigned to urb->transfer_buffer. After the transfer is > complete, an invalid address is left behind in this pointer. This is > not ordinarily a problem since nothing touches that buffer before the > urb is released. However, when usbmon is active, usbmon_urb_complete() > calls (indirectly) mon_bin_get_data() which does access the transfer > buffer if it is set. To prevent an invalid memory access here, reset > urb->tranfer_buffer to NULL when finished (musb_host_rx()), or do not
WARNING: 'tranfer' may be misspelled
I have fixed it locally.
> set it at all (musb_host_tx()). > > Fixes: 8e8a55165469 ("usb: musb: host: Handle highmem in PIO mode") > Signed-off-by: Mans Rullgard <mans@mansr.com>
Applied. Thanks. -Bin.
| |