Message ID | ef8466b834c1726f5404c95c3e192e90460146f8.1695934946.git.mirq-linux@rere.qmqm.pl |
---|---|
State | New |
Headers |
Return-Path: <linux-kernel-owner@vger.kernel.org> Delivered-To: ouuuleilei@gmail.com Received: by 2002:a59:cae8:0:b0:403:3b70:6f57 with SMTP id r8csp3636296vqu; Thu, 28 Sep 2023 15:21:47 -0700 (PDT) X-Google-Smtp-Source: AGHT+IHNU1OVkcDemWs8TjE1O8ZouHcPOABitLRGsoIwYnWMxVOv6EIZDxwA7mUUqLkCFmMgK49N X-Received: by 2002:a17:902:cec3:b0:1bd:a22a:d409 with SMTP id d3-20020a170902cec300b001bda22ad409mr3058487plg.40.1695939707096; Thu, 28 Sep 2023 15:21:47 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1695939707; cv=none; d=google.com; s=arc-20160816; b=baHXPjsblScVwNzWQBbGu9zTtZUxVx5KWeiuZq3JjLE77p3+UAxH7OCzgDPvVRUfJi P9Vuc1zzkxjrRNwVkzPFvHretMd5sCK/M1LA+wMTqRp6MqaifaPEJoJxlovUArzuXd8Q 66EX6IHVaYfuyzSFfJirOXfYcBeEu+91OwQ+7ZFtljEayetwhNosVs/n0QVkymSn/ZOw zJkuTtvUwbHFdZpwgDl9/K2Oi9M+lcLAES2SQ4VDXoXKZmupuZ0Gu9t3eLjqQ74GWYOz Le0qNA7mmgNxdRgBf2arCpCSlshwvDfzQG6PMxwyNeP4G/Xc6Q5jYRcLFdgyPpn1JML0 YSzg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:cc:to:from:content-transfer-encoding :mime-version:subject:references:in-reply-to:message-id:date :dkim-signature; bh=jzkRk4C/aV+Afj1MmaWAhYxJDZubPsv/OM2YLUau710=; fh=FxRMgmc2sPAmzcacoKB2ZQq5FrvY37JdvWxZaUx0x3M=; b=rzk2HpNADnAnQg0cYO9X+CO6g+YGOv9HS96yc37VcR9gdZJWdc3JaLQ/tPZYWdkxSs n0r+VUMOkWKAKp/Y0dH1qItYEhBcJ48fcugJtzT4+JjPDrlZTqhMHd+hNYKj6SXjC8lu ebh+sK46xDUcVRNXqeupjacPfdFr8QsUoAJHVkNPBeJEr22hFEilkTFGGWBkOwtrhxzu hJjt8bX+eTi7kH3yh/yFzZypnT6GYaXJuahpg3x14TnnC1IOtuR6faYujKM0bX53wy6e UVbSO///vZ9a8W/7Gqi4ithb4IG/VGTOFh5b3kvln9pOiB0UJpYKid1jHskJEYma7DKr vl5w== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@rere.qmqm.pl header.s=1 header.b=EvGqQJm2; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::3:7 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=rere.qmqm.pl Received: from snail.vger.email (snail.vger.email. [2620:137:e000::3:7]) by mx.google.com with ESMTPS id u16-20020a170902e81000b001c5bab14164si21142946plg.60.2023.09.28.15.21.46 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 28 Sep 2023 15:21:47 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::3:7 as permitted sender) client-ip=2620:137:e000::3:7; Authentication-Results: mx.google.com; dkim=pass header.i=@rere.qmqm.pl header.s=1 header.b=EvGqQJm2; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::3:7 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=rere.qmqm.pl Received: from out1.vger.email (depot.vger.email [IPv6:2620:137:e000::3:0]) by snail.vger.email (Postfix) with ESMTP id 19A898343526; Thu, 28 Sep 2023 14:06:38 -0700 (PDT) X-Virus-Status: Clean X-Virus-Scanned: clamav-milter 0.103.10 at snail.vger.email Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S232461AbjI1VGT (ORCPT <rfc822;pwkd43@gmail.com> + 22 others); Thu, 28 Sep 2023 17:06:19 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:54908 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S232367AbjI1VGO (ORCPT <rfc822;linux-kernel@vger.kernel.org>); Thu, 28 Sep 2023 17:06:14 -0400 Received: from rere.qmqm.pl (rere.qmqm.pl [91.227.64.183]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 0EA301B6; Thu, 28 Sep 2023 14:06:06 -0700 (PDT) Received: from remote.user (localhost [127.0.0.1]) by rere.qmqm.pl (Postfix) with ESMTPSA id 4RxQxl49rkzFZ; Thu, 28 Sep 2023 23:06:03 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=rere.qmqm.pl; s=1; t=1695935163; bh=iiQS8kMeezpTy3iMeiyaI+cO7grb0g3SKJXNiRAc2Yo=; h=Date:In-Reply-To:References:Subject:From:To:Cc:From; b=EvGqQJm2Fyuc6VcP9qxCVZVQK/cLRarleYOJ+9lLdM/DS92y4ah+/eXQHWlM4n/74 UR5/vv0oPPhZl1v1RZNJHpQ/rUq/FGfLATQ0WR6FjnHXIJS3wXpKKYtcshC9U11u/+ MSvWDkDyXZu0EtRjlKFZmqT74SBetfi1/j0OYB5H7EukJRUhQyH5nE0K5+wIKrHAt/ 75417JEt2t5SmuQJuQpBCJL/NA9LT61TXI3SXiYMnpdAKoZmm1o++g9Oiik6Z0ti8j 2fLVbfD+Wv1F4QZyH/CGk7ceOizdQdJr1bXkfrYFENR/Kvq0W1ZNaiHyndM6d4xW77 Z0YiJw0AVbdZw== X-Virus-Status: Clean X-Virus-Scanned: clamav-milter 0.103.10 at mail Date: Thu, 28 Sep 2023 23:06:03 +0200 Message-Id: <ef8466b834c1726f5404c95c3e192e90460146f8.1695934946.git.mirq-linux@rere.qmqm.pl> In-Reply-To: <cover.1695934946.git.mirq-linux@rere.qmqm.pl> References: <cover.1695934946.git.mirq-linux@rere.qmqm.pl> Subject: [PATCH v2 1/3] usb: chipidea: Fix DMA overwrite for Tegra MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit From: =?utf-8?b?TWljaGHFgiBNaXJvc8WCYXc=?= <mirq-linux@rere.qmqm.pl> To: Peter Chen <peter.chen@kernel.org>, Greg Kroah-Hartman <gregkh@linuxfoundation.org>, Peter Geis <pgwipeout@gmail.com>, Thierry Reding <treding@nvidia.com>, Dmitry Osipenko <digetx@gmail.com> Cc: linux-usb@vger.kernel.org, linux-kernel@vger.kernel.org, linux-tegra@vger.kernel.org X-Spam-Status: No, score=-2.0 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,RCVD_IN_DNSWL_BLOCKED,SPF_HELO_PASS,SPF_PASS autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: <linux-kernel.vger.kernel.org> X-Mailing-List: linux-kernel@vger.kernel.org X-Greylist: Sender passed SPF test, not delayed by milter-greylist-4.6.4 (snail.vger.email [0.0.0.0]); Thu, 28 Sep 2023 14:06:38 -0700 (PDT) X-getmail-retrieved-from-mailbox: INBOX X-GMAIL-THRID: 1778321674469411318 X-GMAIL-MSGID: 1778321674469411318 |
Series |
usb: chipidea: An USB DMA fix + cleanups for Tegra
|
|
Commit Message
Michał Mirosław
Sept. 28, 2023, 9:06 p.m. UTC
Tegra USB controllers seem to issue DMA in full 32-bit words only and thus
may overwrite unevenly-sized buffers. One such occurrence is detected by
SLUB when receiving a reply to a 1-byte buffer (below). Fix this by
allocating a bounce buffer also for buffers with sizes not a multiple of 4.
=============================================================================
BUG kmalloc-64 (Tainted: G B ): kmalloc Redzone overwritten
-----------------------------------------------------------------------------
0x8555cd02-0x8555cd03 @offset=3330. First byte 0x0 instead of 0xcc
Allocated in usb_get_status+0x2b/0xac age=1 cpu=3 pid=41
__kmem_cache_alloc_node+0x12f/0x1e4
__kmalloc+0x33/0x8c
usb_get_status+0x2b/0xac
hub_probe+0x5e9/0xcec
usb_probe_interface+0xbf/0x21c
really_probe+0xa5/0x2c4
__driver_probe_device+0x75/0x174
driver_probe_device+0x31/0x94
__device_attach_driver+0x65/0xc0
bus_for_each_drv+0x4b/0x74
__device_attach+0x69/0x120
bus_probe_device+0x65/0x6c
device_add+0x48b/0x5f8
usb_set_configuration+0x37b/0x6b4
usb_generic_driver_probe+0x37/0x68
usb_probe_device+0x35/0xb4
Slab 0xbf622b80 objects=21 used=18 fp=0x8555cdc0 flags=0x800(slab|zone=0)
Object 0x8555cd00 @offset=3328 fp=0x00000000
Redzone 8555ccc0: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc ................
Redzone 8555ccd0: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc ................
Redzone 8555cce0: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc ................
Redzone 8555ccf0: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc ................
Object 8555cd00: 01 00 00 00 cc cc cc cc cc cc cc cc cc cc cc cc ................
Object 8555cd10: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc ................
Object 8555cd20: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc ................
Object 8555cd30: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc ................
Redzone 8555cd40: cc cc cc cc ....
Padding 8555cd74: 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a ZZZZZZZZZZZZ
CPU: 3 PID: 41 Comm: kworker/3:1 Tainted: G B 6.6.0-rc1mq-00118-g59786f827ea1 #1115
Hardware name: NVIDIA Tegra SoC (Flattened Device Tree)
Workqueue: usb_hub_wq hub_event
[<8010ca28>] (unwind_backtrace) from [<801090a5>] (show_stack+0x11/0x14)
[<801090a5>] (show_stack) from [<805da2fb>] (dump_stack_lvl+0x4d/0x7c)
[<805da2fb>] (dump_stack_lvl) from [<8026464f>] (check_bytes_and_report+0xb3/0xe4)
[<8026464f>] (check_bytes_and_report) from [<802648e1>] (check_object+0x261/0x290)
[<802648e1>] (check_object) from [<802671b1>] (free_to_partial_list+0x105/0x3f8)
[<802671b1>] (free_to_partial_list) from [<80268613>] (__kmem_cache_free+0x103/0x128)
[<80268613>] (__kmem_cache_free) from [<80425a67>] (usb_get_status+0x73/0xac)
[<80425a67>] (usb_get_status) from [<80421b31>] (hub_probe+0x5e9/0xcec)
[<80421b31>] (hub_probe) from [<80428bbb>] (usb_probe_interface+0xbf/0x21c)
[<80428bbb>] (usb_probe_interface) from [<803ee13d>] (really_probe+0xa5/0x2c4)
[<803ee13d>] (really_probe) from [<803ee3d1>] (__driver_probe_device+0x75/0x174)
[<803ee3d1>] (__driver_probe_device) from [<803ee501>] (driver_probe_device+0x31/0x94)
usb 1-1: device descriptor read/8, error -71
Fixes: fc53d5279094 ("usb: chipidea: tegra: Support host mode")
Signed-off-by: Michał Mirosław <mirq-linux@rere.qmqm.pl>
---
drivers/usb/chipidea/host.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
Comments
On Thu, Sep 28, 2023 at 11:06:03PM +0200, Michał Mirosław wrote: > Tegra USB controllers seem to issue DMA in full 32-bit words only and thus > may overwrite unevenly-sized buffers. One such occurrence is detected by > SLUB when receiving a reply to a 1-byte buffer (below). Fix this by > allocating a bounce buffer also for buffers with sizes not a multiple of 4. > > ============================================================================= > BUG kmalloc-64 (Tainted: G B ): kmalloc Redzone overwritten > ----------------------------------------------------------------------------- > > 0x8555cd02-0x8555cd03 @offset=3330. First byte 0x0 instead of 0xcc > Allocated in usb_get_status+0x2b/0xac age=1 cpu=3 pid=41 > __kmem_cache_alloc_node+0x12f/0x1e4 > __kmalloc+0x33/0x8c > usb_get_status+0x2b/0xac > hub_probe+0x5e9/0xcec > usb_probe_interface+0xbf/0x21c > really_probe+0xa5/0x2c4 > __driver_probe_device+0x75/0x174 > driver_probe_device+0x31/0x94 > __device_attach_driver+0x65/0xc0 > bus_for_each_drv+0x4b/0x74 > __device_attach+0x69/0x120 > bus_probe_device+0x65/0x6c > device_add+0x48b/0x5f8 > usb_set_configuration+0x37b/0x6b4 > usb_generic_driver_probe+0x37/0x68 > usb_probe_device+0x35/0xb4 > Slab 0xbf622b80 objects=21 used=18 fp=0x8555cdc0 flags=0x800(slab|zone=0) > Object 0x8555cd00 @offset=3328 fp=0x00000000 > > Redzone 8555ccc0: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc ................ > Redzone 8555ccd0: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc ................ > Redzone 8555cce0: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc ................ > Redzone 8555ccf0: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc ................ > Object 8555cd00: 01 00 00 00 cc cc cc cc cc cc cc cc cc cc cc cc ................ > Object 8555cd10: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc ................ > Object 8555cd20: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc ................ > Object 8555cd30: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc ................ > Redzone 8555cd40: cc cc cc cc .... > Padding 8555cd74: 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a ZZZZZZZZZZZZ > CPU: 3 PID: 41 Comm: kworker/3:1 Tainted: G B 6.6.0-rc1mq-00118-g59786f827ea1 #1115 > Hardware name: NVIDIA Tegra SoC (Flattened Device Tree) > Workqueue: usb_hub_wq hub_event > [<8010ca28>] (unwind_backtrace) from [<801090a5>] (show_stack+0x11/0x14) > [<801090a5>] (show_stack) from [<805da2fb>] (dump_stack_lvl+0x4d/0x7c) > [<805da2fb>] (dump_stack_lvl) from [<8026464f>] (check_bytes_and_report+0xb3/0xe4) > [<8026464f>] (check_bytes_and_report) from [<802648e1>] (check_object+0x261/0x290) > [<802648e1>] (check_object) from [<802671b1>] (free_to_partial_list+0x105/0x3f8) > [<802671b1>] (free_to_partial_list) from [<80268613>] (__kmem_cache_free+0x103/0x128) > [<80268613>] (__kmem_cache_free) from [<80425a67>] (usb_get_status+0x73/0xac) > [<80425a67>] (usb_get_status) from [<80421b31>] (hub_probe+0x5e9/0xcec) > [<80421b31>] (hub_probe) from [<80428bbb>] (usb_probe_interface+0xbf/0x21c) > [<80428bbb>] (usb_probe_interface) from [<803ee13d>] (really_probe+0xa5/0x2c4) > [<803ee13d>] (really_probe) from [<803ee3d1>] (__driver_probe_device+0x75/0x174) > [<803ee3d1>] (__driver_probe_device) from [<803ee501>] (driver_probe_device+0x31/0x94) > usb 1-1: device descriptor read/8, error -71 > > Fixes: fc53d5279094 ("usb: chipidea: tegra: Support host mode") > Signed-off-by: Michał Mirosław <mirq-linux@rere.qmqm.pl> > --- > drivers/usb/chipidea/host.c | 7 ++++--- > 1 file changed, 4 insertions(+), 3 deletions(-) Acked-by: Thierry Reding <treding@nvidia.com>
On 23-09-28 23:06:03, Michał Mirosław wrote: > Tegra USB controllers seem to issue DMA in full 32-bit words only and thus > may overwrite unevenly-sized buffers. One such occurrence is detected by > SLUB when receiving a reply to a 1-byte buffer (below). Fix this by > allocating a bounce buffer also for buffers with sizes not a multiple of 4. > > ============================================================================= > BUG kmalloc-64 (Tainted: G B ): kmalloc Redzone overwritten > ----------------------------------------------------------------------------- > > 0x8555cd02-0x8555cd03 @offset=3330. First byte 0x0 instead of 0xcc > Allocated in usb_get_status+0x2b/0xac age=1 cpu=3 pid=41 > __kmem_cache_alloc_node+0x12f/0x1e4 > __kmalloc+0x33/0x8c > usb_get_status+0x2b/0xac > hub_probe+0x5e9/0xcec > usb_probe_interface+0xbf/0x21c > really_probe+0xa5/0x2c4 > __driver_probe_device+0x75/0x174 > driver_probe_device+0x31/0x94 > __device_attach_driver+0x65/0xc0 > bus_for_each_drv+0x4b/0x74 > __device_attach+0x69/0x120 > bus_probe_device+0x65/0x6c > device_add+0x48b/0x5f8 > usb_set_configuration+0x37b/0x6b4 > usb_generic_driver_probe+0x37/0x68 > usb_probe_device+0x35/0xb4 > Slab 0xbf622b80 objects=21 used=18 fp=0x8555cdc0 flags=0x800(slab|zone=0) > Object 0x8555cd00 @offset=3328 fp=0x00000000 > > Redzone 8555ccc0: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc ................ > Redzone 8555ccd0: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc ................ > Redzone 8555cce0: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc ................ > Redzone 8555ccf0: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc ................ > Object 8555cd00: 01 00 00 00 cc cc cc cc cc cc cc cc cc cc cc cc ................ > Object 8555cd10: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc ................ > Object 8555cd20: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc ................ > Object 8555cd30: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc ................ > Redzone 8555cd40: cc cc cc cc .... > Padding 8555cd74: 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a 5a ZZZZZZZZZZZZ > CPU: 3 PID: 41 Comm: kworker/3:1 Tainted: G B 6.6.0-rc1mq-00118-g59786f827ea1 #1115 > Hardware name: NVIDIA Tegra SoC (Flattened Device Tree) > Workqueue: usb_hub_wq hub_event > [<8010ca28>] (unwind_backtrace) from [<801090a5>] (show_stack+0x11/0x14) > [<801090a5>] (show_stack) from [<805da2fb>] (dump_stack_lvl+0x4d/0x7c) > [<805da2fb>] (dump_stack_lvl) from [<8026464f>] (check_bytes_and_report+0xb3/0xe4) > [<8026464f>] (check_bytes_and_report) from [<802648e1>] (check_object+0x261/0x290) > [<802648e1>] (check_object) from [<802671b1>] (free_to_partial_list+0x105/0x3f8) > [<802671b1>] (free_to_partial_list) from [<80268613>] (__kmem_cache_free+0x103/0x128) > [<80268613>] (__kmem_cache_free) from [<80425a67>] (usb_get_status+0x73/0xac) > [<80425a67>] (usb_get_status) from [<80421b31>] (hub_probe+0x5e9/0xcec) > [<80421b31>] (hub_probe) from [<80428bbb>] (usb_probe_interface+0xbf/0x21c) > [<80428bbb>] (usb_probe_interface) from [<803ee13d>] (really_probe+0xa5/0x2c4) > [<803ee13d>] (really_probe) from [<803ee3d1>] (__driver_probe_device+0x75/0x174) > [<803ee3d1>] (__driver_probe_device) from [<803ee501>] (driver_probe_device+0x31/0x94) > usb 1-1: device descriptor read/8, error -71 > > Fixes: fc53d5279094 ("usb: chipidea: tegra: Support host mode") > Signed-off-by: Michał Mirosław <mirq-linux@rere.qmqm.pl> Acked-by: Peter Chen <peter.chen@kernel.org> > --- > drivers/usb/chipidea/host.c | 7 ++++--- > 1 file changed, 4 insertions(+), 3 deletions(-) > > diff --git a/drivers/usb/chipidea/host.c b/drivers/usb/chipidea/host.c > index 08af26b762a2..abddd39d1ff1 100644 > --- a/drivers/usb/chipidea/host.c > +++ b/drivers/usb/chipidea/host.c > @@ -411,12 +411,13 @@ static int ci_hdrc_alloc_dma_aligned_buffer(struct urb *urb, gfp_t mem_flags) > const unsigned int ci_hdrc_usb_dma_align = 32; > size_t kmalloc_size; > > - if (urb->num_sgs || urb->sg || urb->transfer_buffer_length == 0 || > - !((uintptr_t)urb->transfer_buffer & (ci_hdrc_usb_dma_align - 1))) > + if (urb->num_sgs || urb->sg || urb->transfer_buffer_length == 0) > + return 0; > + if (!((uintptr_t)urb->transfer_buffer & (ci_hdrc_usb_dma_align - 1)) && !(urb->transfer_buffer_length & 3)) > return 0; > > /* Allocate a buffer with enough padding for alignment */ > - kmalloc_size = urb->transfer_buffer_length + > + kmalloc_size = ALIGN(urb->transfer_buffer_length, 4) + > sizeof(struct ci_hdrc_dma_aligned_buffer) + > ci_hdrc_usb_dma_align - 1; > > -- > 2.39.2 >
diff --git a/drivers/usb/chipidea/host.c b/drivers/usb/chipidea/host.c index 08af26b762a2..abddd39d1ff1 100644 --- a/drivers/usb/chipidea/host.c +++ b/drivers/usb/chipidea/host.c @@ -411,12 +411,13 @@ static int ci_hdrc_alloc_dma_aligned_buffer(struct urb *urb, gfp_t mem_flags) const unsigned int ci_hdrc_usb_dma_align = 32; size_t kmalloc_size; - if (urb->num_sgs || urb->sg || urb->transfer_buffer_length == 0 || - !((uintptr_t)urb->transfer_buffer & (ci_hdrc_usb_dma_align - 1))) + if (urb->num_sgs || urb->sg || urb->transfer_buffer_length == 0) + return 0; + if (!((uintptr_t)urb->transfer_buffer & (ci_hdrc_usb_dma_align - 1)) && !(urb->transfer_buffer_length & 3)) return 0; /* Allocate a buffer with enough padding for alignment */ - kmalloc_size = urb->transfer_buffer_length + + kmalloc_size = ALIGN(urb->transfer_buffer_length, 4) + sizeof(struct ci_hdrc_dma_aligned_buffer) + ci_hdrc_usb_dma_align - 1;