Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux

net/usb/r8152: make sure the USB buffer is DMA-able

Allocate the required memory before calling usb_control_msg. And
the additional memory copy is necessary.

Signed-off-by: Hayes Wang <hayeswang@realtek.com>
Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

authored by

hayeswang and committed by
David S. Miller
31787f53 543ae7f9

+35 -25
+35 -25
drivers/net/usb/r8152.c
··· 344 344 static 345 345 int get_registers(struct r8152 *tp, u16 value, u16 index, u16 size, void *data) 346 346 { 347 - return usb_control_msg(tp->udev, usb_rcvctrlpipe(tp->udev, 0), 347 + int ret; 348 + void *tmp; 349 + 350 + tmp = kmalloc(size, GFP_KERNEL); 351 + if (!tmp) 352 + return -ENOMEM; 353 + 354 + ret = usb_control_msg(tp->udev, usb_rcvctrlpipe(tp->udev, 0), 348 355 RTL8152_REQ_GET_REGS, RTL8152_REQT_READ, 349 - value, index, data, size, 500); 356 + value, index, tmp, size, 500); 357 + 358 + memcpy(data, tmp, size); 359 + kfree(tmp); 360 + 361 + return ret; 350 362 } 351 363 352 364 static 353 365 int set_registers(struct r8152 *tp, u16 value, u16 index, u16 size, void *data) 354 366 { 355 - return usb_control_msg(tp->udev, usb_sndctrlpipe(tp->udev, 0), 367 + int ret; 368 + void *tmp; 369 + 370 + tmp = kmalloc(size, GFP_KERNEL); 371 + if (!tmp) 372 + return -ENOMEM; 373 + 374 + memcpy(tmp, data, size); 375 + 376 + ret = usb_control_msg(tp->udev, usb_sndctrlpipe(tp->udev, 0), 356 377 RTL8152_REQ_SET_REGS, RTL8152_REQT_WRITE, 357 - value, index, data, size, 500); 378 + value, index, tmp, size, 500); 379 + 380 + kfree(tmp); 381 + return ret; 358 382 } 359 383 360 384 static int generic_ocp_read(struct r8152 *tp, u16 index, u16 size, ··· 709 685 static inline void set_ethernet_addr(struct r8152 *tp) 710 686 { 711 687 struct net_device *dev = tp->netdev; 712 - u8 *node_id; 688 + u8 node_id[8] = {0}; 713 689 714 - node_id = kmalloc(sizeof(u8) * 8, GFP_KERNEL); 715 - if (!node_id) { 716 - netif_err(tp, probe, dev, "out of memory"); 717 - return; 718 - } 719 - 720 - if (pla_ocp_read(tp, PLA_IDR, sizeof(u8) * 8, node_id) < 0) 690 + if (pla_ocp_read(tp, PLA_IDR, sizeof(node_id), node_id) < 0) 721 691 netif_notice(tp, probe, dev, "inet addr fail\n"); 722 692 else { 723 693 memcpy(dev->dev_addr, node_id, dev->addr_len); 724 694 memcpy(dev->perm_addr, dev->dev_addr, dev->addr_len); 725 695 } 726 - kfree(node_id); 727 696 } 728 697 729 698 static int rtl8152_set_mac_address(struct net_device *netdev, void *p) ··· 899 882 static void _rtl8152_set_rx_mode(struct net_device *netdev) 900 883 { 901 884 struct r8152 *tp = netdev_priv(netdev); 902 - u32 tmp, *mc_filter; /* Multicast hash filter */ 885 + u32 mc_filter[2]; /* Multicast hash filter */ 886 + __le32 tmp[2]; 903 887 u32 ocp_data; 904 - 905 - mc_filter = kmalloc(sizeof(u32) * 2, GFP_KERNEL); 906 - if (!mc_filter) { 907 - netif_err(tp, link, netdev, "out of memory"); 908 - return; 909 - } 910 888 911 889 clear_bit(RTL8152_SET_RX_MODE, &tp->flags); 912 890 netif_stop_queue(netdev); ··· 930 918 } 931 919 } 932 920 933 - tmp = mc_filter[0]; 934 - mc_filter[0] = __cpu_to_le32(swab32(mc_filter[1])); 935 - mc_filter[1] = __cpu_to_le32(swab32(tmp)); 921 + tmp[0] = __cpu_to_le32(swab32(mc_filter[1])); 922 + tmp[1] = __cpu_to_le32(swab32(mc_filter[0])); 936 923 937 - pla_ocp_write(tp, PLA_MAR, BYTE_EN_DWORD, sizeof(u32) * 2, mc_filter); 924 + pla_ocp_write(tp, PLA_MAR, BYTE_EN_DWORD, sizeof(tmp), tmp); 938 925 ocp_write_dword(tp, MCU_TYPE_PLA, PLA_RCR, ocp_data); 939 926 netif_wake_queue(netdev); 940 - kfree(mc_filter); 941 927 } 942 928 943 929 static netdev_tx_t rtl8152_start_xmit(struct sk_buff *skb,