Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit ddb6b5a9 authored by Jussi Kivilinna's avatar Jussi Kivilinna Committed by Takashi Iwai
Browse files

ALSA: 6fire: fix DMA issues with URB transfer_buffer usage 



Patch fixes 6fire not to use stack as URB transfer_buffer. URB buffers need to
be DMA-able, which stack is not. Furthermore, transfer_buffer should not be
allocated as part of larger device structure because DMA coherency issues and
patch fixes this issue too.

Cc: stable@vger.kernel.org
Signed-off-by: default avatarJussi Kivilinna <jussi.kivilinna@iki.fi>
Tested-by: default avatarTorsten Schenk <torsten.schenk@zoho.com>
Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
parent 697aebab

sound/usb/6fire/comm.c

+33 −5
Original line number Diff line number Diff line
@@ -110,19 +110,37 @@ static int usb6fire_comm_send_buffer(u8 *buffer, struct usb_device *dev) 
static int usb6fire_comm_write8(struct comm_runtime *rt, u8 request,

		u8 reg, u8 value)

{

	u8 buffer[13]; /* 13: maximum length of message */

	u8 *buffer;

	int ret;



	/* 13: maximum length of message */

	buffer = kmalloc(13, GFP_KERNEL);

	if (!buffer)

		return -ENOMEM;



	usb6fire_comm_init_buffer(buffer, 0x00, request, reg, value, 0x00);

	return usb6fire_comm_send_buffer(buffer, rt->chip->dev);

	ret = usb6fire_comm_send_buffer(buffer, rt->chip->dev);



	kfree(buffer);

	return ret;

}



static int usb6fire_comm_write16(struct comm_runtime *rt, u8 request,

		u8 reg, u8 vl, u8 vh)

{

	u8 buffer[13]; /* 13: maximum length of message */

	u8 *buffer;

	int ret;



	/* 13: maximum length of message */

	buffer = kmalloc(13, GFP_KERNEL);

	if (!buffer)

		return -ENOMEM;



	usb6fire_comm_init_buffer(buffer, 0x00, request, reg, vl, vh);

	return usb6fire_comm_send_buffer(buffer, rt->chip->dev);

	ret = usb6fire_comm_send_buffer(buffer, rt->chip->dev);



	kfree(buffer);

	return ret;

}



int usb6fire_comm_init(struct sfire_chip *chip)
@@ -135,6 +153,12 @@ int usb6fire_comm_init(struct sfire_chip *chip) 
	if (!rt)

		return -ENOMEM;



	rt->receiver_buffer = kzalloc(COMM_RECEIVER_BUFSIZE, GFP_KERNEL);

	if (!rt->receiver_buffer) {

		kfree(rt);

		return -ENOMEM;

	}



	urb = &rt->receiver;

	rt->serial = 1;

	rt->chip = chip;
@@ -153,6 +177,7 @@ int usb6fire_comm_init(struct sfire_chip *chip) 
	urb->interval = 1;

	ret = usb_submit_urb(urb, GFP_KERNEL);

	if (ret < 0) {

		kfree(rt->receiver_buffer);

		kfree(rt);

		snd_printk(KERN_ERR PREFIX "cannot create comm data receiver.");

		return ret;
@@ -171,6 +196,9 @@ void usb6fire_comm_abort(struct sfire_chip *chip) 


void usb6fire_comm_destroy(struct sfire_chip *chip)

{

	kfree(chip->comm);

	struct comm_runtime *rt = chip->comm;



	kfree(rt->receiver_buffer);

	kfree(rt);

	chip->comm = NULL;

}

sound/usb/6fire/comm.h

+1 −1
Original line number Diff line number Diff line
@@ -24,7 +24,7 @@ struct comm_runtime { 
	struct sfire_chip *chip;



	struct urb receiver;

	u8 receiver_buffer[COMM_RECEIVER_BUFSIZE];

	u8 *receiver_buffer;



	u8 serial; /* urb serial */