Commit 68fc92a0 authored by Antti Seppälä's avatar Antti Seppälä Committed by Greg Kroah-Hartman

usb: dwc2: Fix DMA alignment to start at allocated boundary

commit 56406e01 upstream.

The commit 3bc04e28 ("usb: dwc2: host: Get aligned DMA in a more
supported way") introduced a common way to align DMA allocations.
The code in the commit aligns the struct dma_aligned_buffer but the
actual DMA address pointed by data[0] gets aligned to an offset from
the allocated boundary by the kmalloc_ptr and the old_xfer_buffer

This is against the recommendation in Documentation/DMA-API.txt which

  Therefore, it is recommended that driver writers who don't take
  special care to determine the cache line size at run time only map
  virtual regions that begin and end on page boundaries (which are
  guaranteed also to be cache line boundaries).

The effect of this is that architectures with non-coherent DMA caches
may run into memory corruption or kernel crashes with Unhandled
kernel unaligned accesses exceptions.

Fix the alignment by positioning the DMA area in front of the allocation
and use memory at the end of the area for storing the orginal
transfer_buffer pointer. This may have the added benefit of increased
performance as the DMA area is now fully aligned on all architectures.

Tested with Lantiq xRX200 (MIPS) and RPi Model B Rev 2 (ARM).

Fixes: 3bc04e28 ("usb: dwc2: host: Get aligned DMA in a more supported way")
Cc: <>
Reviewed-by: default avatarDouglas Anderson <>
Signed-off-by: default avatarAntti Seppälä <>
Signed-off-by: default avatarFelipe Balbi <>
Signed-off-by: default avatarGreg Kroah-Hartman <>
parent ac3f65c6
......@@ -2606,34 +2606,29 @@ static void dwc2_hc_init_xfer(struct dwc2_hsotg *hsotg,
#define DWC2_USB_DMA_ALIGN 4
struct dma_aligned_buffer {
void *kmalloc_ptr;
void *old_xfer_buffer;
u8 data[0];
static void dwc2_free_dma_aligned_buffer(struct urb *urb)
struct dma_aligned_buffer *temp;
void *stored_xfer_buffer;
if (!(urb->transfer_flags & URB_ALIGNED_TEMP_BUFFER))
temp = container_of(urb->transfer_buffer,
struct dma_aligned_buffer, data);
/* Restore urb->transfer_buffer from the end of the allocated area */
memcpy(&stored_xfer_buffer, urb->transfer_buffer +
urb->transfer_buffer_length, sizeof(urb->transfer_buffer));
if (usb_urb_dir_in(urb))
memcpy(temp->old_xfer_buffer, temp->data,
memcpy(stored_xfer_buffer, urb->transfer_buffer,
urb->transfer_buffer = temp->old_xfer_buffer;
urb->transfer_buffer = stored_xfer_buffer;
urb->transfer_flags &= ~URB_ALIGNED_TEMP_BUFFER;
static int dwc2_alloc_dma_aligned_buffer(struct urb *urb, gfp_t mem_flags)
struct dma_aligned_buffer *temp, *kmalloc_ptr;
void *kmalloc_ptr;
size_t kmalloc_size;
if (urb->num_sgs || urb->sg ||
......@@ -2641,22 +2636,29 @@ static int dwc2_alloc_dma_aligned_buffer(struct urb *urb, gfp_t mem_flags)
!((uintptr_t)urb->transfer_buffer & (DWC2_USB_DMA_ALIGN - 1)))
return 0;
/* Allocate a buffer with enough padding for alignment */
* Allocate a buffer with enough padding for original transfer_buffer
* pointer. This allocation is guaranteed to be aligned properly for
kmalloc_size = urb->transfer_buffer_length +
sizeof(struct dma_aligned_buffer) + DWC2_USB_DMA_ALIGN - 1;
kmalloc_ptr = kmalloc(kmalloc_size, mem_flags);
if (!kmalloc_ptr)
return -ENOMEM;
/* Position our struct dma_aligned_buffer such that data is aligned */
temp = PTR_ALIGN(kmalloc_ptr + 1, DWC2_USB_DMA_ALIGN) - 1;
temp->kmalloc_ptr = kmalloc_ptr;
temp->old_xfer_buffer = urb->transfer_buffer;
* Position value of original urb->transfer_buffer pointer to the end
* of allocation for later referencing
memcpy(kmalloc_ptr + urb->transfer_buffer_length,
&urb->transfer_buffer, sizeof(urb->transfer_buffer));
if (usb_urb_dir_out(urb))
memcpy(temp->data, urb->transfer_buffer,
memcpy(kmalloc_ptr, urb->transfer_buffer,
urb->transfer_buffer = temp->data;
urb->transfer_buffer = kmalloc_ptr;
urb->transfer_flags |= URB_ALIGNED_TEMP_BUFFER;
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment