diff options
author | Lars-Peter Clausen <lars@metafoo.de> | 2018-01-12 11:05:02 +0100 |
---|---|---|
committer | Dongwoo Lee <dwoo08.lee@samsung.com> | 2019-11-26 11:23:15 +0900 |
commit | e90745c33dbcbf5fb7a34b05e0e50a9e882c9337 (patch) | |
tree | bed533a026177be215c0751b92055c7734974bcd | |
parent | fbc155b9161c29d1927e255c156b0bf3091f65df (diff) | |
download | linux-4.9-exynos9110-e90745c33dbcbf5fb7a34b05e0e50a9e882c9337.tar.gz linux-4.9-exynos9110-e90745c33dbcbf5fb7a34b05e0e50a9e882c9337.tar.bz2 linux-4.9-exynos9110-e90745c33dbcbf5fb7a34b05e0e50a9e882c9337.zip |
usb: gadget: ffs: Execute copy_to_user() with USER_DS set
[ Upstream commit 4058ebf33cb0be88ca516f968eda24ab7b6b93e4 ]
When using a AIO read() operation on the function FS gadget driver a URB is
submitted asynchronously and on URB completion the received data is copied
to the userspace buffer associated with the read operation.
This is done from a kernel worker thread invoking copy_to_user() (through
copy_to_iter()). And while the user space process memory is made available
to the kernel thread using use_mm(), some architecture require in addition
to this that the operation runs with USER_DS set. Otherwise the userspace
memory access will fail.
For example on ARM64 with Privileged Access Never (PAN) and User Access
Override (UAO) enabled the following crash occurs.
Internal error: Accessing user space memory with fs=KERNEL_DS: 9600004f [#1] SMP
Modules linked in:
CPU: 2 PID: 1636 Comm: kworker/2:1 Not tainted 4.9.0-04081-g8ab2dfb-dirty #487
Hardware name: ZynqMP ZCU102 Rev1.0 (DT)
Workqueue: events ffs_user_copy_worker
task: ffffffc87afc8080 task.stack: ffffffc87a00c000
PC is at __arch_copy_to_user+0x190/0x220
LR is at copy_to_iter+0x78/0x3c8
[...]
[<ffffff800847b790>] __arch_copy_to_user+0x190/0x220
[<ffffff80086f25d8>] ffs_user_copy_worker+0x70/0x130
[<ffffff80080b8c64>] process_one_work+0x1dc/0x460
[<ffffff80080b8f38>] worker_thread+0x50/0x4b0
[<ffffff80080bf5a0>] kthread+0xd8/0xf0
[<ffffff8008083680>] ret_from_fork+0x10/0x50
Address this by placing a set_fs(USER_DS) before of the copy operation
and revert it again once the copy operation has finished.
This patch is analogous to commit d7ffde35e31a ("vhost: use USER_DS in
vhost_worker thread") which addresses the same underlying issue.
Signed-off-by: Lars-Peter Clausen <lars@metafoo.de>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[dwoo08.lee: cherry-pick linux-4.9.y stable commit 5209c778346a to stablize f_fs]
Signed-off-by: Dongwoo Lee <dwoo08.lee@samsung.com>
Change-Id: Iee47b31c16c2f83540e4e1f8bd3f3eaebd727ad2
-rw-r--r-- | drivers/usb/gadget/function/f_fs.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c index 600bd8ed6ecc..da7a4865b361 100644 --- a/drivers/usb/gadget/function/f_fs.c +++ b/drivers/usb/gadget/function/f_fs.c @@ -760,9 +760,13 @@ static void ffs_user_copy_worker(struct work_struct *work) bool kiocb_has_eventfd = io_data->kiocb->ki_flags & IOCB_EVENTFD; if (io_data->read && ret > 0) { + mm_segment_t oldfs = get_fs(); + + set_fs(USER_DS); use_mm(io_data->mm); ret = ffs_copy_to_iter(io_data->buf, ret, &io_data->data); unuse_mm(io_data->mm); + set_fs(oldfs); } io_data->kiocb->ki_complete(io_data->kiocb, ret, ret); |