Skip to content

Commit cbf286e

Browse files
matnymangregkh
matnyman
authored and
gregkh
committed
xhci: fix unsafe memory usage in xhci tracing
Removes static char buffer usage in the following decode functions: xhci_decode_trb() xhci_decode_ptortsc() Caller must provide a buffer to use. In tracing use __get_str() as recommended to pass buffer. Minor chanes are needed in xhci debugfs code as these functions are also used there. Changes include moving XHCI_MSG_MAX definititon from xhci-trace.h to xhci.h Cc: <stable@vger.kernel.org> Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com> Link: https://lore.kernel.org/r/20210820123503.2605901-2-mathias.nyman@linux.intel.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
1 parent d7428bc commit cbf286e

File tree

3 files changed

+36
-30
lines changed

3 files changed

+36
-30
lines changed

‎drivers/usb/host/xhci-debugfs.c‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -198,12 +198,13 @@ static void xhci_ring_dump_segment(struct seq_file *s,
198198
int i;
199199
dma_addr_t dma;
200200
union xhci_trb *trb;
201+
char str[XHCI_MSG_MAX];
201202

202203
for (i = 0; i < TRBS_PER_SEGMENT; i++) {
203204
trb = &seg->trbs[i];
204205
dma = seg->dma + i * sizeof(*trb);
205206
seq_printf(s, "%pad: %s\n", &dma,
206-
xhci_decode_trb(le32_to_cpu(trb->generic.field[0]),
207+
xhci_decode_trb(str, XHCI_MSG_MAX, le32_to_cpu(trb->generic.field[0]),
207208
le32_to_cpu(trb->generic.field[1]),
208209
le32_to_cpu(trb->generic.field[2]),
209210
le32_to_cpu(trb->generic.field[3])));
@@ -341,9 +342,10 @@ static int xhci_portsc_show(struct seq_file *s, void *unused)
341342
{
342343
struct xhci_port *port = s->private;
343344
u32 portsc;
345+
char str[XHCI_MSG_MAX];
344346

345347
portsc = readl(port->addr);
346-
seq_printf(s, "%s\n", xhci_decode_portsc(portsc));
348+
seq_printf(s, "%s\n", xhci_decode_portsc(str, portsc));
347349

348350
return 0;
349351
}

‎drivers/usb/host/xhci-trace.h‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -25,8 +25,6 @@
2525
#include "xhci.h"
2626
#include "xhci-dbgcap.h"
2727

28-
#define XHCI_MSG_MAX 500
29-
3028
DECLARE_EVENT_CLASS(xhci_log_msg,
3129
TP_PROTO(struct va_format *vaf),
3230
TP_ARGS(vaf),
@@ -122,6 +120,7 @@ DECLARE_EVENT_CLASS(xhci_log_trb,
122120
__field(u32, field1)
123121
__field(u32, field2)
124122
__field(u32, field3)
123+
__dynamic_array(char, str, XHCI_MSG_MAX)
125124
),
126125
TP_fast_assign(
127126
__entry->type = ring->type;
@@ -131,7 +130,7 @@ DECLARE_EVENT_CLASS(xhci_log_trb,
131130
__entry->field3 = le32_to_cpu(trb->field[3]);
132131
),
133132
TP_printk("%s: %s", xhci_ring_type_string(__entry->type),
134-
xhci_decode_trb(__entry->field0, __entry->field1,
133+
xhci_decode_trb(__get_str(str), XHCI_MSG_MAX, __entry->field0, __entry->field1,
135134
__entry->field2, __entry->field3)
136135
)
137136
);
@@ -523,14 +522,15 @@ DECLARE_EVENT_CLASS(xhci_log_portsc,
523522
TP_STRUCT__entry(
524523
__field(u32, portnum)
525524
__field(u32, portsc)
525+
__dynamic_array(char, str, XHCI_MSG_MAX)
526526
),
527527
TP_fast_assign(
528528
__entry->portnum = portnum;
529529
__entry->portsc = portsc;
530530
),
531531
TP_printk("port-%d: %s",
532532
__entry->portnum,
533-
xhci_decode_portsc(__entry->portsc)
533+
xhci_decode_portsc(__get_str(str), __entry->portsc)
534534
)
535535
);
536536

‎drivers/usb/host/xhci.h‎

Lines changed: 28 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,9 @@
2222
#include "xhci-ext-caps.h"
2323
#include "pci-quirks.h"
2424

25+
/* max buffer size for trace and debug messages */
26+
#define XHCI_MSG_MAX 500
27+
2528
/* xHCI PCI Configuration Registers */
2629
#define XHCI_SBRN_OFFSET (0x60)
2730

@@ -2235,15 +2238,14 @@ static inline char *xhci_slot_state_string(u32 state)
22352238
}
22362239
}
22372240

2238-
static inline const char *xhci_decode_trb(u32 field0, u32 field1, u32 field2,
2239-
u32 field3)
2241+
static inline const char *xhci_decode_trb(char *str, size_t size,
2242+
u32 field0, u32 field1, u32 field2, u32 field3)
22402243
{
2241-
static char str[256];
22422244
int type = TRB_FIELD_TO_TYPE(field3);
22432245

22442246
switch (type) {
22452247
case TRB_LINK:
2246-
sprintf(str,
2248+
snprintf(str, size,
22472249
"LINK %08x%08x intr %d type '%s' flags %c:%c:%c:%c",
22482250
field1, field0, GET_INTR_TARGET(field2),
22492251
xhci_trb_type_string(type),
@@ -2260,7 +2262,7 @@ static inline const char *xhci_decode_trb(u32 field0, u32 field1, u32 field2,
22602262
case TRB_HC_EVENT:
22612263
case TRB_DEV_NOTE:
22622264
case TRB_MFINDEX_WRAP:
2263-
sprintf(str,
2265+
snprintf(str, size,
22642266
"TRB %08x%08x status '%s' len %d slot %d ep %d type '%s' flags %c:%c",
22652267
field1, field0,
22662268
xhci_trb_comp_code_string(GET_COMP_CODE(field2)),
@@ -2273,7 +2275,8 @@ static inline const char *xhci_decode_trb(u32 field0, u32 field1, u32 field2,
22732275

22742276
break;
22752277
case TRB_SETUP:
2276-
sprintf(str, "bRequestType %02x bRequest %02x wValue %02x%02x wIndex %02x%02x wLength %d length %d TD size %d intr %d type '%s' flags %c:%c:%c",
2278+
snprintf(str, size,
2279+
"bRequestType %02x bRequest %02x wValue %02x%02x wIndex %02x%02x wLength %d length %d TD size %d intr %d type '%s' flags %c:%c:%c",
22772280
field0 & 0xff,
22782281
(field0 & 0xff00) >> 8,
22792282
(field0 & 0xff000000) >> 24,
@@ -2290,7 +2293,8 @@ static inline const char *xhci_decode_trb(u32 field0, u32 field1, u32 field2,
22902293
field3 & TRB_CYCLE ? 'C' : 'c');
22912294
break;
22922295
case TRB_DATA:
2293-
sprintf(str, "Buffer %08x%08x length %d TD size %d intr %d type '%s' flags %c:%c:%c:%c:%c:%c:%c",
2296+
snprintf(str, size,
2297+
"Buffer %08x%08x length %d TD size %d intr %d type '%s' flags %c:%c:%c:%c:%c:%c:%c",
22942298
field1, field0, TRB_LEN(field2), GET_TD_SIZE(field2),
22952299
GET_INTR_TARGET(field2),
22962300
xhci_trb_type_string(type),
@@ -2303,7 +2307,8 @@ static inline const char *xhci_decode_trb(u32 field0, u32 field1, u32 field2,
23032307
field3 & TRB_CYCLE ? 'C' : 'c');
23042308
break;
23052309
case TRB_STATUS:
2306-
sprintf(str, "Buffer %08x%08x length %d TD size %d intr %d type '%s' flags %c:%c:%c:%c",
2310+
snprintf(str, size,
2311+
"Buffer %08x%08x length %d TD size %d intr %d type '%s' flags %c:%c:%c:%c",
23072312
field1, field0, TRB_LEN(field2), GET_TD_SIZE(field2),
23082313
GET_INTR_TARGET(field2),
23092314
xhci_trb_type_string(type),
@@ -2316,7 +2321,7 @@ static inline const char *xhci_decode_trb(u32 field0, u32 field1, u32 field2,
23162321
case TRB_ISOC:
23172322
case TRB_EVENT_DATA:
23182323
case TRB_TR_NOOP:
2319-
sprintf(str,
2324+
snprintf(str, size,
23202325
"Buffer %08x%08x length %d TD size %d intr %d type '%s' flags %c:%c:%c:%c:%c:%c:%c:%c",
23212326
field1, field0, TRB_LEN(field2), GET_TD_SIZE(field2),
23222327
GET_INTR_TARGET(field2),
@@ -2333,21 +2338,21 @@ static inline const char *xhci_decode_trb(u32 field0, u32 field1, u32 field2,
23332338

23342339
case TRB_CMD_NOOP:
23352340
case TRB_ENABLE_SLOT:
2336-
sprintf(str,
2341+
snprintf(str, size,
23372342
"%s: flags %c",
23382343
xhci_trb_type_string(type),
23392344
field3 & TRB_CYCLE ? 'C' : 'c');
23402345
break;
23412346
case TRB_DISABLE_SLOT:
23422347
case TRB_NEG_BANDWIDTH:
2343-
sprintf(str,
2348+
snprintf(str, size,
23442349
"%s: slot %d flags %c",
23452350
xhci_trb_type_string(type),
23462351
TRB_TO_SLOT_ID(field3),
23472352
field3 & TRB_CYCLE ? 'C' : 'c');
23482353
break;
23492354
case TRB_ADDR_DEV:
2350-
sprintf(str,
2355+
snprintf(str, size,
23512356
"%s: ctx %08x%08x slot %d flags %c:%c",
23522357
xhci_trb_type_string(type),
23532358
field1, field0,
@@ -2356,7 +2361,7 @@ static inline const char *xhci_decode_trb(u32 field0, u32 field1, u32 field2,
23562361
field3 & TRB_CYCLE ? 'C' : 'c');
23572362
break;
23582363
case TRB_CONFIG_EP:
2359-
sprintf(str,
2364+
snprintf(str, size,
23602365
"%s: ctx %08x%08x slot %d flags %c:%c",
23612366
xhci_trb_type_string(type),
23622367
field1, field0,
@@ -2365,15 +2370,15 @@ static inline const char *xhci_decode_trb(u32 field0, u32 field1, u32 field2,
23652370
field3 & TRB_CYCLE ? 'C' : 'c');
23662371
break;
23672372
case TRB_EVAL_CONTEXT:
2368-
sprintf(str,
2373+
snprintf(str, size,
23692374
"%s: ctx %08x%08x slot %d flags %c",
23702375
xhci_trb_type_string(type),
23712376
field1, field0,
23722377
TRB_TO_SLOT_ID(field3),
23732378
field3 & TRB_CYCLE ? 'C' : 'c');
23742379
break;
23752380
case TRB_RESET_EP:
2376-
sprintf(str,
2381+
snprintf(str, size,
23772382
"%s: ctx %08x%08x slot %d ep %d flags %c:%c",
23782383
xhci_trb_type_string(type),
23792384
field1, field0,
@@ -2394,7 +2399,7 @@ static inline const char *xhci_decode_trb(u32 field0, u32 field1, u32 field2,
23942399
field3 & TRB_CYCLE ? 'C' : 'c');
23952400
break;
23962401
case TRB_SET_DEQ:
2397-
sprintf(str,
2402+
snprintf(str, size,
23982403
"%s: deq %08x%08x stream %d slot %d ep %d flags %c",
23992404
xhci_trb_type_string(type),
24002405
field1, field0,
@@ -2405,14 +2410,14 @@ static inline const char *xhci_decode_trb(u32 field0, u32 field1, u32 field2,
24052410
field3 & TRB_CYCLE ? 'C' : 'c');
24062411
break;
24072412
case TRB_RESET_DEV:
2408-
sprintf(str,
2413+
snprintf(str, size,
24092414
"%s: slot %d flags %c",
24102415
xhci_trb_type_string(type),
24112416
TRB_TO_SLOT_ID(field3),
24122417
field3 & TRB_CYCLE ? 'C' : 'c');
24132418
break;
24142419
case TRB_FORCE_EVENT:
2415-
sprintf(str,
2420+
snprintf(str, size,
24162421
"%s: event %08x%08x vf intr %d vf id %d flags %c",
24172422
xhci_trb_type_string(type),
24182423
field1, field0,
@@ -2421,14 +2426,14 @@ static inline const char *xhci_decode_trb(u32 field0, u32 field1, u32 field2,
24212426
field3 & TRB_CYCLE ? 'C' : 'c');
24222427
break;
24232428
case TRB_SET_LT:
2424-
sprintf(str,
2429+
snprintf(str, size,
24252430
"%s: belt %d flags %c",
24262431
xhci_trb_type_string(type),
24272432
TRB_TO_BELT(field3),
24282433
field3 & TRB_CYCLE ? 'C' : 'c');
24292434
break;
24302435
case TRB_GET_BW:
2431-
sprintf(str,
2436+
snprintf(str, size,
24322437
"%s: ctx %08x%08x slot %d speed %d flags %c",
24332438
xhci_trb_type_string(type),
24342439
field1, field0,
@@ -2437,7 +2442,7 @@ static inline const char *xhci_decode_trb(u32 field0, u32 field1, u32 field2,
24372442
field3 & TRB_CYCLE ? 'C' : 'c');
24382443
break;
24392444
case TRB_FORCE_HEADER:
2440-
sprintf(str,
2445+
snprintf(str, size,
24412446
"%s: info %08x%08x%08x pkt type %d roothub port %d flags %c",
24422447
xhci_trb_type_string(type),
24432448
field2, field1, field0 & 0xffffffe0,
@@ -2446,7 +2451,7 @@ static inline const char *xhci_decode_trb(u32 field0, u32 field1, u32 field2,
24462451
field3 & TRB_CYCLE ? 'C' : 'c');
24472452
break;
24482453
default:
2449-
sprintf(str,
2454+
snprintf(str, size,
24502455
"type '%s' -> raw %08x %08x %08x %08x",
24512456
xhci_trb_type_string(type),
24522457
field0, field1, field2, field3);
@@ -2571,9 +2576,8 @@ static inline const char *xhci_portsc_link_state_string(u32 portsc)
25712576
return "Unknown";
25722577
}
25732578

2574-
static inline const char *xhci_decode_portsc(u32 portsc)
2579+
static inline const char *xhci_decode_portsc(char *str, u32 portsc)
25752580
{
2576-
static char str[256];
25772581
int ret;
25782582

25792583
ret = sprintf(str, "%s %s %s Link:%s PortSpeed:%d ",

0 commit comments

Comments
 (0)