Loading drivers/usb/gadget/composite.c +2 −1 Original line number Diff line number Diff line Loading @@ -2267,7 +2267,8 @@ int composite_dev_prepare(struct usb_composite_driver *composite, if (!cdev->req) return -ENOMEM; cdev->req->buf = kmalloc(USB_COMP_EP0_BUFSIZ, GFP_KERNEL); cdev->req->buf = kmalloc(USB_COMP_EP0_BUFSIZ + (gadget->extra_buf_alloc), GFP_KERNEL); if (!cdev->req->buf) goto fail; Loading drivers/usb/gadget/function/f_accessory.c +2 −1 Original line number Diff line number Diff line Loading @@ -586,7 +586,8 @@ static int create_bulk_endpoints(struct acc_dev *dev, /* now allocate requests for our endpoints */ for (i = 0; i < TX_REQ_MAX; i++) { req = acc_request_new(dev->ep_in, BULK_BUFFER_SIZE); req = acc_request_new(dev->ep_in, BULK_BUFFER_SIZE + cdev->gadget->extra_buf_alloc); if (!req) goto fail; req->complete = acc_complete_in; Loading drivers/usb/gadget/function/f_fs.c +24 −6 Original line number Diff line number Diff line Loading @@ -281,7 +281,8 @@ static void ffs_closed(struct ffs_data *ffs); static int ffs_mutex_lock(struct mutex *mutex, unsigned nonblock) __attribute__((warn_unused_result, nonnull)); static char *ffs_prepare_buffer(const char __user *buf, size_t len) static char *ffs_prepare_buffer(const char __user *buf, size_t len, size_t extra_buf_alloc) __attribute__((warn_unused_result, nonnull)); Loading Loading @@ -357,6 +358,7 @@ static ssize_t ffs_ep0_write(struct file *file, const char __user *buf, size_t len, loff_t *ptr) { struct ffs_data *ffs = file->private_data; struct usb_gadget *gadget = ffs->gadget; ssize_t ret; char *data; Loading Loading @@ -388,7 +390,7 @@ static ssize_t ffs_ep0_write(struct file *file, const char __user *buf, break; } data = ffs_prepare_buffer(buf, len); data = ffs_prepare_buffer(buf, len, 0); if (IS_ERR(data)) { ret = PTR_ERR(data); break; Loading Loading @@ -460,7 +462,7 @@ static ssize_t ffs_ep0_write(struct file *file, const char __user *buf, spin_unlock_irq(&ffs->ev.waitq.lock); data = ffs_prepare_buffer(buf, len); data = ffs_prepare_buffer(buf, len, gadget->extra_buf_alloc); if (IS_ERR(data)) { ret = PTR_ERR(data); break; Loading Loading @@ -982,9 +984,11 @@ static ssize_t ffs_epfile_io(struct file *file, struct ffs_io_data *io_data) struct ffs_epfile *epfile = file->private_data; struct usb_request *req; struct ffs_ep *ep; struct ffs_data *ffs = epfile->ffs; char *data = NULL; ssize_t ret, data_len = -EINVAL; int halt; size_t extra_buf_alloc = 0; ffs_log("enter: epfile name %s epfile err %d (%s)", epfile->name, atomic_read(&epfile->error), io_data->read ? "READ" : "WRITE"); Loading Loading @@ -1075,6 +1079,11 @@ static ssize_t ffs_epfile_io(struct file *file, struct ffs_io_data *io_data) data_len = usb_ep_align_maybe(gadget, ep->ep, data_len); spin_unlock_irq(&epfile->ffs->eps_lock); extra_buf_alloc = ffs->gadget->extra_buf_alloc; if (io_data->read) data = kmalloc(data_len + extra_buf_alloc, GFP_KERNEL); else data = kmalloc(data_len, GFP_KERNEL); if (unlikely(!data)) { ret = -ENOMEM; Loading Loading @@ -4370,14 +4379,23 @@ static int ffs_mutex_lock(struct mutex *mutex, unsigned nonblock) : mutex_lock_interruptible(mutex); } static char *ffs_prepare_buffer(const char __user *buf, size_t len) /** * ffs_prepare_buffer() - copy userspace buffer into kernel. * @buf: userspace buffer * @len: length of the buffer * @extra_alloc_buf: Extra buffer allocation if required by UDC. * * This function returns pointer to the copied buffer */ static char *ffs_prepare_buffer(const char __user *buf, size_t len, size_t extra_buf_alloc) { char *data; if (unlikely(!len)) return NULL; data = kmalloc(len, GFP_KERNEL); data = kmalloc(len + extra_buf_alloc, GFP_KERNEL); if (unlikely(!data)) return ERR_PTR(-ENOMEM); Loading drivers/usb/gadget/function/f_mass_storage.c +2 −1 Original line number Diff line number Diff line Loading @@ -2750,7 +2750,8 @@ int fsg_common_set_num_buffers(struct fsg_common *common, unsigned int n) bh->next = bh + 1; ++bh; buffhds_first_it: bh->buf = kmalloc(FSG_BUFLEN, GFP_KERNEL); bh->buf = kmalloc(FSG_BUFLEN + EXTRA_ALLOCATION_SIZE, GFP_KERNEL); if (unlikely(!bh->buf)) goto error_release; } while (--i); Loading drivers/usb/gadget/function/f_mtp.c +5 −2 Original line number Diff line number Diff line Loading @@ -497,6 +497,7 @@ static int mtp_create_bulk_endpoints(struct mtp_dev *dev, struct usb_composite_dev *cdev = dev->cdev; struct usb_request *req; struct usb_ep *ep; size_t extra_buf_alloc = cdev->gadget->extra_buf_alloc; int i; DBG(cdev, "create_bulk_endpoints dev: %pK\n", dev); Loading Loading @@ -531,7 +532,8 @@ static int mtp_create_bulk_endpoints(struct mtp_dev *dev, retry_tx_alloc: /* now allocate requests for our endpoints */ for (i = 0; i < mtp_tx_reqs; i++) { req = mtp_request_new(dev->ep_in, mtp_tx_req_len); req = mtp_request_new(dev->ep_in, mtp_tx_req_len + extra_buf_alloc); if (!req) { if (mtp_tx_req_len <= MTP_BULK_BUFFER_SIZE) goto fail; Loading Loading @@ -569,7 +571,8 @@ static int mtp_create_bulk_endpoints(struct mtp_dev *dev, dev->rx_req[i] = req; } for (i = 0; i < INTR_REQ_MAX; i++) { req = mtp_request_new(dev->ep_intr, INTR_BUFFER_SIZE); req = mtp_request_new(dev->ep_intr, INTR_BUFFER_SIZE + extra_buf_alloc); if (!req) goto fail; req->complete = mtp_complete_intr; Loading Loading
drivers/usb/gadget/composite.c +2 −1 Original line number Diff line number Diff line Loading @@ -2267,7 +2267,8 @@ int composite_dev_prepare(struct usb_composite_driver *composite, if (!cdev->req) return -ENOMEM; cdev->req->buf = kmalloc(USB_COMP_EP0_BUFSIZ, GFP_KERNEL); cdev->req->buf = kmalloc(USB_COMP_EP0_BUFSIZ + (gadget->extra_buf_alloc), GFP_KERNEL); if (!cdev->req->buf) goto fail; Loading
drivers/usb/gadget/function/f_accessory.c +2 −1 Original line number Diff line number Diff line Loading @@ -586,7 +586,8 @@ static int create_bulk_endpoints(struct acc_dev *dev, /* now allocate requests for our endpoints */ for (i = 0; i < TX_REQ_MAX; i++) { req = acc_request_new(dev->ep_in, BULK_BUFFER_SIZE); req = acc_request_new(dev->ep_in, BULK_BUFFER_SIZE + cdev->gadget->extra_buf_alloc); if (!req) goto fail; req->complete = acc_complete_in; Loading
drivers/usb/gadget/function/f_fs.c +24 −6 Original line number Diff line number Diff line Loading @@ -281,7 +281,8 @@ static void ffs_closed(struct ffs_data *ffs); static int ffs_mutex_lock(struct mutex *mutex, unsigned nonblock) __attribute__((warn_unused_result, nonnull)); static char *ffs_prepare_buffer(const char __user *buf, size_t len) static char *ffs_prepare_buffer(const char __user *buf, size_t len, size_t extra_buf_alloc) __attribute__((warn_unused_result, nonnull)); Loading Loading @@ -357,6 +358,7 @@ static ssize_t ffs_ep0_write(struct file *file, const char __user *buf, size_t len, loff_t *ptr) { struct ffs_data *ffs = file->private_data; struct usb_gadget *gadget = ffs->gadget; ssize_t ret; char *data; Loading Loading @@ -388,7 +390,7 @@ static ssize_t ffs_ep0_write(struct file *file, const char __user *buf, break; } data = ffs_prepare_buffer(buf, len); data = ffs_prepare_buffer(buf, len, 0); if (IS_ERR(data)) { ret = PTR_ERR(data); break; Loading Loading @@ -460,7 +462,7 @@ static ssize_t ffs_ep0_write(struct file *file, const char __user *buf, spin_unlock_irq(&ffs->ev.waitq.lock); data = ffs_prepare_buffer(buf, len); data = ffs_prepare_buffer(buf, len, gadget->extra_buf_alloc); if (IS_ERR(data)) { ret = PTR_ERR(data); break; Loading Loading @@ -982,9 +984,11 @@ static ssize_t ffs_epfile_io(struct file *file, struct ffs_io_data *io_data) struct ffs_epfile *epfile = file->private_data; struct usb_request *req; struct ffs_ep *ep; struct ffs_data *ffs = epfile->ffs; char *data = NULL; ssize_t ret, data_len = -EINVAL; int halt; size_t extra_buf_alloc = 0; ffs_log("enter: epfile name %s epfile err %d (%s)", epfile->name, atomic_read(&epfile->error), io_data->read ? "READ" : "WRITE"); Loading Loading @@ -1075,6 +1079,11 @@ static ssize_t ffs_epfile_io(struct file *file, struct ffs_io_data *io_data) data_len = usb_ep_align_maybe(gadget, ep->ep, data_len); spin_unlock_irq(&epfile->ffs->eps_lock); extra_buf_alloc = ffs->gadget->extra_buf_alloc; if (io_data->read) data = kmalloc(data_len + extra_buf_alloc, GFP_KERNEL); else data = kmalloc(data_len, GFP_KERNEL); if (unlikely(!data)) { ret = -ENOMEM; Loading Loading @@ -4370,14 +4379,23 @@ static int ffs_mutex_lock(struct mutex *mutex, unsigned nonblock) : mutex_lock_interruptible(mutex); } static char *ffs_prepare_buffer(const char __user *buf, size_t len) /** * ffs_prepare_buffer() - copy userspace buffer into kernel. * @buf: userspace buffer * @len: length of the buffer * @extra_alloc_buf: Extra buffer allocation if required by UDC. * * This function returns pointer to the copied buffer */ static char *ffs_prepare_buffer(const char __user *buf, size_t len, size_t extra_buf_alloc) { char *data; if (unlikely(!len)) return NULL; data = kmalloc(len, GFP_KERNEL); data = kmalloc(len + extra_buf_alloc, GFP_KERNEL); if (unlikely(!data)) return ERR_PTR(-ENOMEM); Loading
drivers/usb/gadget/function/f_mass_storage.c +2 −1 Original line number Diff line number Diff line Loading @@ -2750,7 +2750,8 @@ int fsg_common_set_num_buffers(struct fsg_common *common, unsigned int n) bh->next = bh + 1; ++bh; buffhds_first_it: bh->buf = kmalloc(FSG_BUFLEN, GFP_KERNEL); bh->buf = kmalloc(FSG_BUFLEN + EXTRA_ALLOCATION_SIZE, GFP_KERNEL); if (unlikely(!bh->buf)) goto error_release; } while (--i); Loading
drivers/usb/gadget/function/f_mtp.c +5 −2 Original line number Diff line number Diff line Loading @@ -497,6 +497,7 @@ static int mtp_create_bulk_endpoints(struct mtp_dev *dev, struct usb_composite_dev *cdev = dev->cdev; struct usb_request *req; struct usb_ep *ep; size_t extra_buf_alloc = cdev->gadget->extra_buf_alloc; int i; DBG(cdev, "create_bulk_endpoints dev: %pK\n", dev); Loading Loading @@ -531,7 +532,8 @@ static int mtp_create_bulk_endpoints(struct mtp_dev *dev, retry_tx_alloc: /* now allocate requests for our endpoints */ for (i = 0; i < mtp_tx_reqs; i++) { req = mtp_request_new(dev->ep_in, mtp_tx_req_len); req = mtp_request_new(dev->ep_in, mtp_tx_req_len + extra_buf_alloc); if (!req) { if (mtp_tx_req_len <= MTP_BULK_BUFFER_SIZE) goto fail; Loading Loading @@ -569,7 +571,8 @@ static int mtp_create_bulk_endpoints(struct mtp_dev *dev, dev->rx_req[i] = req; } for (i = 0; i < INTR_REQ_MAX; i++) { req = mtp_request_new(dev->ep_intr, INTR_BUFFER_SIZE); req = mtp_request_new(dev->ep_intr, INTR_BUFFER_SIZE + extra_buf_alloc); if (!req) goto fail; req->complete = mtp_complete_intr; Loading