Commit 4c3de592 authored by Jussi Kivilinna's avatar Jussi Kivilinna Committed by John W. Linville

rtlwifi: fix incorrect use of usb_alloc_coherent with usb_control_msg

Incorrect use of usb_alloc_coherent memory as input buffer to usb_control_msg
can cause problems in arch DMA code, for example kernel BUG at
'arch/arm/include/asm/dma-mapping.h:321' on ARM (linux-3.4).

Change _usb_writeN_sync use kmalloc'd buffer instead.

Cc: stable@vger.kernel.org
Signed-off-by: default avatarJussi Kivilinna <jussi.kivilinna@mbnet.fi>
Acked-by: default avatarLarry Finger <Larry.Finger@lwfinger.net>
Signed-off-by: default avatarJohn W. Linville <linville@tuxdriver.com>
parent 12e94327
...@@ -210,17 +210,16 @@ static void _usb_writeN_sync(struct rtl_priv *rtlpriv, u32 addr, void *data, ...@@ -210,17 +210,16 @@ static void _usb_writeN_sync(struct rtl_priv *rtlpriv, u32 addr, void *data,
u16 index = REALTEK_USB_VENQT_CMD_IDX; u16 index = REALTEK_USB_VENQT_CMD_IDX;
int pipe = usb_sndctrlpipe(udev, 0); /* write_out */ int pipe = usb_sndctrlpipe(udev, 0); /* write_out */
u8 *buffer; u8 *buffer;
dma_addr_t dma_addr;
wvalue = (u16)(addr&0x0000ffff); wvalue = (u16)(addr & 0x0000ffff);
buffer = usb_alloc_coherent(udev, (size_t)len, GFP_ATOMIC, &dma_addr); buffer = kmalloc(len, GFP_ATOMIC);
if (!buffer) if (!buffer)
return; return;
memcpy(buffer, data, len); memcpy(buffer, data, len);
usb_control_msg(udev, pipe, request, reqtype, wvalue, usb_control_msg(udev, pipe, request, reqtype, wvalue,
index, buffer, len, 50); index, buffer, len, 50);
usb_free_coherent(udev, (size_t)len, buffer, dma_addr); kfree(buffer);
} }
static void _rtl_usb_io_handler_init(struct device *dev, static void _rtl_usb_io_handler_init(struct device *dev,
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment