Skip to content

Commit 4843b4b

Browse files
matnymangregkh
matnyman
authored and
gregkh
committed
xhci: fix even more unsafe memory usage in xhci tracing
Removes static char buffer usage in the following decode functions: xhci_decode_ctrl_ctx() xhci_decode_slot_context() xhci_decode_usbsts() xhci_decode_doorbell() xhci_decode_ep_context() Caller must provide a buffer to use. In tracing use __get_str() as recommended to pass buffer. Minor changes are needed in other xhci code as these functions are also used elsewhere Cc: <stable@vger.kernel.org> Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com> Link: https://lore.kernel.org/r/20210820123503.2605901-3-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
1 parent cbf286e commit 4843b4b

File tree

4 files changed

+27
-23
lines changed

4 files changed

+27
-23
lines changed

‎drivers/usb/host/xhci-debugfs.c‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -261,11 +261,13 @@ static int xhci_slot_context_show(struct seq_file *s, void *unused)
261261
struct xhci_slot_ctx *slot_ctx;
262262
struct xhci_slot_priv *priv = s->private;
263263
struct xhci_virt_device *dev = priv->dev;
264+
char str[XHCI_MSG_MAX];
264265

265266
xhci = hcd_to_xhci(bus_to_hcd(dev->udev->bus));
266267
slot_ctx = xhci_get_slot_ctx(xhci, dev->out_ctx);
267268
seq_printf(s, "%pad: %s\n", &dev->out_ctx->dma,
268-
xhci_decode_slot_context(le32_to_cpu(slot_ctx->dev_info),
269+
xhci_decode_slot_context(str,
270+
le32_to_cpu(slot_ctx->dev_info),
269271
le32_to_cpu(slot_ctx->dev_info2),
270272
le32_to_cpu(slot_ctx->tt_info),
271273
le32_to_cpu(slot_ctx->dev_state)));
@@ -281,14 +283,16 @@ static int xhci_endpoint_context_show(struct seq_file *s, void *unused)
281283
struct xhci_ep_ctx *ep_ctx;
282284
struct xhci_slot_priv *priv = s->private;
283285
struct xhci_virt_device *dev = priv->dev;
286+
char str[XHCI_MSG_MAX];
284287

285288
xhci = hcd_to_xhci(bus_to_hcd(dev->udev->bus));
286289

287290
for (ep_index = 0; ep_index < 31; ep_index++) {
288291
ep_ctx = xhci_get_ep_ctx(xhci, dev->out_ctx, ep_index);
289292
dma = dev->out_ctx->dma + (ep_index + 1) * CTX_SIZE(xhci->hcc_params);
290293
seq_printf(s, "%pad: %s\n", &dma,
291-
xhci_decode_ep_context(le32_to_cpu(ep_ctx->ep_info),
294+
xhci_decode_ep_context(str,
295+
le32_to_cpu(ep_ctx->ep_info),
292296
le32_to_cpu(ep_ctx->ep_info2),
293297
le64_to_cpu(ep_ctx->deq),
294298
le32_to_cpu(ep_ctx->tx_info)));

‎drivers/usb/host/xhci-ring.c‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1212,6 +1212,7 @@ void xhci_stop_endpoint_command_watchdog(struct timer_list *t)
12121212
struct xhci_hcd *xhci = ep->xhci;
12131213
unsigned long flags;
12141214
u32 usbsts;
1215+
char str[XHCI_MSG_MAX];
12151216

12161217
spin_lock_irqsave(&xhci->lock, flags);
12171218

@@ -1225,7 +1226,7 @@ void xhci_stop_endpoint_command_watchdog(struct timer_list *t)
12251226
usbsts = readl(&xhci->op_regs->status);
12261227

12271228
xhci_warn(xhci, "xHCI host not responding to stop endpoint command.\n");
1228-
xhci_warn(xhci, "USBSTS:%s\n", xhci_decode_usbsts(usbsts));
1229+
xhci_warn(xhci, "USBSTS:%s\n", xhci_decode_usbsts(str, usbsts));
12291230

12301231
ep->ep_state &= ~EP_STOP_CMD_PENDING;
12311232

‎drivers/usb/host/xhci-trace.h‎

Lines changed: 11 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -322,15 +322,16 @@ DECLARE_EVENT_CLASS(xhci_log_ep_ctx,
322322
__field(u32, info2)
323323
__field(u64, deq)
324324
__field(u32, tx_info)
325+
__dynamic_array(char, str, XHCI_MSG_MAX)
325326
),
326327
TP_fast_assign(
327328
__entry->info = le32_to_cpu(ctx->ep_info);
328329
__entry->info2 = le32_to_cpu(ctx->ep_info2);
329330
__entry->deq = le64_to_cpu(ctx->deq);
330331
__entry->tx_info = le32_to_cpu(ctx->tx_info);
331332
),
332-
TP_printk("%s", xhci_decode_ep_context(__entry->info,
333-
__entry->info2, __entry->deq, __entry->tx_info)
333+
TP_printk("%s", xhci_decode_ep_context(__get_str(str),
334+
__entry->info, __entry->info2, __entry->deq, __entry->tx_info)
334335
)
335336
);
336337

@@ -367,16 +368,17 @@ DECLARE_EVENT_CLASS(xhci_log_slot_ctx,
367368
__field(u32, info2)
368369
__field(u32, tt_info)
369370
__field(u32, state)
371+
__dynamic_array(char, str, XHCI_MSG_MAX)
370372
),
371373
TP_fast_assign(
372374
__entry->info = le32_to_cpu(ctx->dev_info);
373375
__entry->info2 = le32_to_cpu(ctx->dev_info2);
374376
__entry->tt_info = le64_to_cpu(ctx->tt_info);
375377
__entry->state = le32_to_cpu(ctx->dev_state);
376378
),
377-
TP_printk("%s", xhci_decode_slot_context(__entry->info,
378-
__entry->info2, __entry->tt_info,
379-
__entry->state)
379+
TP_printk("%s", xhci_decode_slot_context(__get_str(str),
380+
__entry->info, __entry->info2,
381+
__entry->tt_info, __entry->state)
380382
)
381383
);
382384

@@ -431,12 +433,13 @@ DECLARE_EVENT_CLASS(xhci_log_ctrl_ctx,
431433
TP_STRUCT__entry(
432434
__field(u32, drop)
433435
__field(u32, add)
436+
__dynamic_array(char, str, XHCI_MSG_MAX)
434437
),
435438
TP_fast_assign(
436439
__entry->drop = le32_to_cpu(ctrl_ctx->drop_flags);
437440
__entry->add = le32_to_cpu(ctrl_ctx->add_flags);
438441
),
439-
TP_printk("%s", xhci_decode_ctrl_ctx(__entry->drop, __entry->add)
442+
TP_printk("%s", xhci_decode_ctrl_ctx(__get_str(str), __entry->drop, __entry->add)
440443
)
441444
);
442445

@@ -555,13 +558,14 @@ DECLARE_EVENT_CLASS(xhci_log_doorbell,
555558
TP_STRUCT__entry(
556559
__field(u32, slot)
557560
__field(u32, doorbell)
561+
__dynamic_array(char, str, XHCI_MSG_MAX)
558562
),
559563
TP_fast_assign(
560564
__entry->slot = slot;
561565
__entry->doorbell = doorbell;
562566
),
563567
TP_printk("Ring doorbell for %s",
564-
xhci_decode_doorbell(__entry->slot, __entry->doorbell)
568+
xhci_decode_doorbell(__get_str(str), __entry->slot, __entry->doorbell)
565569
)
566570
);
567571

‎drivers/usb/host/xhci.h‎

Lines changed: 8 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -2460,10 +2460,9 @@ static inline const char *xhci_decode_trb(char *str, size_t size,
24602460
return str;
24612461
}
24622462

2463-
static inline const char *xhci_decode_ctrl_ctx(unsigned long drop,
2464-
unsigned long add)
2463+
static inline const char *xhci_decode_ctrl_ctx(char *str,
2464+
unsigned long drop, unsigned long add)
24652465
{
2466-
static char str[1024];
24672466
unsigned int bit;
24682467
int ret = 0;
24692468

@@ -2489,10 +2488,9 @@ static inline const char *xhci_decode_ctrl_ctx(unsigned long drop,
24892488
return str;
24902489
}
24912490

2492-
static inline const char *xhci_decode_slot_context(u32 info, u32 info2,
2493-
u32 tt_info, u32 state)
2491+
static inline const char *xhci_decode_slot_context(char *str,
2492+
u32 info, u32 info2, u32 tt_info, u32 state)
24942493
{
2495-
static char str[1024];
24962494
u32 speed;
24972495
u32 hub;
24982496
u32 mtt;
@@ -2621,9 +2619,8 @@ static inline const char *xhci_decode_portsc(char *str, u32 portsc)
26212619
return str;
26222620
}
26232621

2624-
static inline const char *xhci_decode_usbsts(u32 usbsts)
2622+
static inline const char *xhci_decode_usbsts(char *str, u32 usbsts)
26252623
{
2626-
static char str[256];
26272624
int ret = 0;
26282625

26292626
if (usbsts == ~(u32)0)
@@ -2650,9 +2647,8 @@ static inline const char *xhci_decode_usbsts(u32 usbsts)
26502647
return str;
26512648
}
26522649

2653-
static inline const char *xhci_decode_doorbell(u32 slot, u32 doorbell)
2650+
static inline const char *xhci_decode_doorbell(char *str, u32 slot, u32 doorbell)
26542651
{
2655-
static char str[256];
26562652
u8 ep;
26572653
u16 stream;
26582654
int ret;
@@ -2719,10 +2715,9 @@ static inline const char *xhci_ep_type_string(u8 type)
27192715
}
27202716
}
27212717

2722-
static inline const char *xhci_decode_ep_context(u32 info, u32 info2, u64 deq,
2723-
u32 tx_info)
2718+
static inline const char *xhci_decode_ep_context(char *str, u32 info,
2719+
u32 info2, u64 deq, u32 tx_info)
27242720
{
2725-
static char str[1024];
27262721
int ret;
27272722

27282723
u32 esit;

0 commit comments

Comments
 (0)