OSDN Git Service

Input: sur40 - fix DMA on stack
authorOliver Neukum <oneukum@suse.com>
Wed, 23 Mar 2016 21:36:56 +0000 (14:36 -0700)
committerDmitry Torokhov <dmitry.torokhov@gmail.com>
Thu, 24 Mar 2016 00:29:30 +0000 (17:29 -0700)
During the initialisation the driver uses a buffer on the stack for DMA.
That violates the cache coherency rules. The fix is to allocate the buffer
with kmalloc().

Signed-off-by: Oliver Neukum <ONeukum@suse.com>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
drivers/input/touchscreen/sur40.c

index b6c4d03..880c40b 100644 (file)
@@ -197,28 +197,34 @@ static int sur40_command(struct sur40_state *dev,
 static int sur40_init(struct sur40_state *dev)
 {
        int result;
-       u8 buffer[24];
+       u8 *buffer;
+
+       buffer = kmalloc(24, GFP_KERNEL);
+       if (!buffer) {
+               result = -ENOMEM;
+               goto error;
+       }
 
        /* stupidly replay the original MS driver init sequence */
        result = sur40_command(dev, SUR40_GET_VERSION, 0x00, buffer, 12);
        if (result < 0)
-               return result;
+               goto error;
 
        result = sur40_command(dev, SUR40_GET_VERSION, 0x01, buffer, 12);
        if (result < 0)
-               return result;
+               goto error;
 
        result = sur40_command(dev, SUR40_GET_VERSION, 0x02, buffer, 12);
        if (result < 0)
-               return result;
+               goto error;
 
        result = sur40_command(dev, SUR40_UNKNOWN2,    0x00, buffer, 24);
        if (result < 0)
-               return result;
+               goto error;
 
        result = sur40_command(dev, SUR40_UNKNOWN1,    0x00, buffer,  5);
        if (result < 0)
-               return result;
+               goto error;
 
        result = sur40_command(dev, SUR40_GET_VERSION, 0x03, buffer, 12);
 
@@ -226,7 +232,8 @@ static int sur40_init(struct sur40_state *dev)
         * Discard the result buffer - no known data inside except
         * some version strings, maybe extract these sometime...
         */
-
+error:
+       kfree(buffer);
        return result;
 }