[PATCH 4.4 17/42] HID: corsair: fix DMA buffers on stack

[Greg Kroah-Hartman]

4.4-stable review patch.  If anyone has any objections, please let me know.

--

From: Johan Hovold 

commit 6d104af38b570d37aa32a5803b04c354f8ed513d upstream.

Not all platforms support DMA to the stack, and specifically since v4.9
this is no longer supported on x86 with VMAP_STACK either.

Note that the macro-mode buffer was larger than necessary.

Fixes: 6f78193ee9ea ("HID: corsair: Add Corsair Vengeance K90 driver")
Signed-off-by: Johan Hovold 
Signed-off-by: Jiri Kosina 
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/hid/hid-corsair.c |   54 +++---
 1 file changed, 42 insertions(+), 12 deletions(-)

--- a/drivers/hid/hid-corsair.c
+++ b/drivers/hid/hid-corsair.c
@@ -148,7 +148,11 @@ static enum led_brightness k90_backlight
struct usb_interface *usbif = to_usb_interface(dev->parent);
struct usb_device *usbdev = interface_to_usbdev(usbif);
int brightness;
-   char data[8];
+   char *data;
+
+   data = kmalloc(8, GFP_KERNEL);
+   if (!data)
+   return -ENOMEM;
 
ret = usb_control_msg(usbdev, usb_rcvctrlpipe(usbdev, 0),
  K90_REQUEST_STATUS,
@@ -158,16 +162,22 @@ static enum led_brightness k90_backlight
if (ret < 0) {
dev_warn(dev, "Failed to get K90 initial state (error %d).\n",
 ret);
-   return -EIO;
+   ret = -EIO;
+   goto out;
}
brightness = data[4];
if (brightness < 0 || brightness > 3) {
dev_warn(dev,
 "Read invalid backlight brightness: %02hhx.\n",
 data[4]);
-   return -EIO;
+   ret = -EIO;
+   goto out;
}
-   return brightness;
+   ret = brightness;
+out:
+   kfree(data);
+
+   return ret;
 }
 
 static enum led_brightness k90_record_led_get(struct led_classdev *led_cdev)
@@ -253,7 +263,11 @@ static ssize_t k90_show_macro_mode(struc
struct usb_interface *usbif = to_usb_interface(dev->parent);
struct usb_device *usbdev = interface_to_usbdev(usbif);
const char *macro_mode;
-   char data[8];
+   char *data;
+
+   data = kmalloc(2, GFP_KERNEL);
+   if (!data)
+   return -ENOMEM;
 
ret = usb_control_msg(usbdev, usb_rcvctrlpipe(usbdev, 0),
  K90_REQUEST_GET_MODE,
@@ -263,7 +277,8 @@ static ssize_t k90_show_macro_mode(struc
if (ret < 0) {
dev_warn(dev, "Failed to get K90 initial mode (error %d).\n",
 ret);
-   return -EIO;
+   ret = -EIO;
+   goto out;
}
 
switch (data[0]) {
@@ -277,10 +292,15 @@ static ssize_t k90_show_macro_mode(struc
default:
dev_warn(dev, "K90 in unknown mode: %02hhx.\n",
 data[0]);
-   return -EIO;
+   ret = -EIO;
+   goto out;
}
 
-   return snprintf(buf, PAGE_SIZE, "%s\n", macro_mode);
+   ret = snprintf(buf, PAGE_SIZE, "%s\n", macro_mode);
+out:
+   kfree(data);
+
+   return ret;
 }
 
 static ssize_t k90_store_macro_mode(struct device *dev,
@@ -320,7 +340,11 @@ static ssize_t k90_show_current_profile(
struct usb_interface *usbif = to_usb_interface(dev->parent);
struct usb_device *usbdev = interface_to_usbdev(usbif);
int current_profile;
-   char data[8];
+   char *data;
+
+   data = kmalloc(8, GFP_KERNEL);
+   if (!data)
+   return -ENOMEM;
 
ret = usb_control_msg(usbdev, usb_rcvctrlpipe(usbdev, 0),
  K90_REQUEST_STATUS,
@@ -330,16 +354,22 @@ static ssize_t k90_show_current_profile(
if (ret < 0) {
dev_warn(dev, "Failed to get K90 initial state (error %d).\n",
 ret);
-   return -EIO;
+   ret = -EIO;
+   goto out;
}
current_profile = data[7];
if (current_profile < 1 || current_profile > 3) {
dev_warn(dev, "Read invalid current profile: %02hhx.\n",
 data[7]);
-   return -EIO;
+   ret = -EIO;
+   goto out;
}
 
-   return snprintf(buf, PAGE_SIZE, "%d\n", current_profile);
+   ret = snprintf(buf, PAGE_SIZE, "%d\n", current_profile);
+out:
+   kfree(data);
+
+   return ret;
 }
 
 static ssize_t k90_store_current_profile(struct device *dev,

[PATCH 4.4 17/42] HID: corsair: fix DMA buffers on stack

[Greg Kroah-Hartman]

4.4-stable review patch.  If anyone has any objections, please let me know.

--

From: Johan Hovold 

commit 6d104af38b570d37aa32a5803b04c354f8ed513d upstream.

Not all platforms support DMA to the stack, and specifically since v4.9
this is no longer supported on x86 with VMAP_STACK either.

Note that the macro-mode buffer was larger than necessary.

Fixes: 6f78193ee9ea ("HID: corsair: Add Corsair Vengeance K90 driver")
Signed-off-by: Johan Hovold 
Signed-off-by: Jiri Kosina 
Signed-off-by: Greg Kroah-Hartman 

---
 drivers/hid/hid-corsair.c |   54 +++---
 1 file changed, 42 insertions(+), 12 deletions(-)

--- a/drivers/hid/hid-corsair.c
+++ b/drivers/hid/hid-corsair.c
@@ -148,7 +148,11 @@ static enum led_brightness k90_backlight
struct usb_interface *usbif = to_usb_interface(dev->parent);
struct usb_device *usbdev = interface_to_usbdev(usbif);
int brightness;
-   char data[8];
+   char *data;
+
+   data = kmalloc(8, GFP_KERNEL);
+   if (!data)
+   return -ENOMEM;
 
ret = usb_control_msg(usbdev, usb_rcvctrlpipe(usbdev, 0),
  K90_REQUEST_STATUS,
@@ -158,16 +162,22 @@ static enum led_brightness k90_backlight
if (ret < 0) {
dev_warn(dev, "Failed to get K90 initial state (error %d).\n",
 ret);
-   return -EIO;
+   ret = -EIO;
+   goto out;
}
brightness = data[4];
if (brightness < 0 || brightness > 3) {
dev_warn(dev,
 "Read invalid backlight brightness: %02hhx.\n",
 data[4]);
-   return -EIO;
+   ret = -EIO;
+   goto out;
}
-   return brightness;
+   ret = brightness;
+out:
+   kfree(data);
+
+   return ret;
 }
 
 static enum led_brightness k90_record_led_get(struct led_classdev *led_cdev)
@@ -253,7 +263,11 @@ static ssize_t k90_show_macro_mode(struc
struct usb_interface *usbif = to_usb_interface(dev->parent);
struct usb_device *usbdev = interface_to_usbdev(usbif);
const char *macro_mode;
-   char data[8];
+   char *data;
+
+   data = kmalloc(2, GFP_KERNEL);
+   if (!data)
+   return -ENOMEM;
 
ret = usb_control_msg(usbdev, usb_rcvctrlpipe(usbdev, 0),
  K90_REQUEST_GET_MODE,
@@ -263,7 +277,8 @@ static ssize_t k90_show_macro_mode(struc
if (ret < 0) {
dev_warn(dev, "Failed to get K90 initial mode (error %d).\n",
 ret);
-   return -EIO;
+   ret = -EIO;
+   goto out;
}
 
switch (data[0]) {
@@ -277,10 +292,15 @@ static ssize_t k90_show_macro_mode(struc
default:
dev_warn(dev, "K90 in unknown mode: %02hhx.\n",
 data[0]);
-   return -EIO;
+   ret = -EIO;
+   goto out;
}
 
-   return snprintf(buf, PAGE_SIZE, "%s\n", macro_mode);
+   ret = snprintf(buf, PAGE_SIZE, "%s\n", macro_mode);
+out:
+   kfree(data);
+
+   return ret;
 }
 
 static ssize_t k90_store_macro_mode(struct device *dev,
@@ -320,7 +340,11 @@ static ssize_t k90_show_current_profile(
struct usb_interface *usbif = to_usb_interface(dev->parent);
struct usb_device *usbdev = interface_to_usbdev(usbif);
int current_profile;
-   char data[8];
+   char *data;
+
+   data = kmalloc(8, GFP_KERNEL);
+   if (!data)
+   return -ENOMEM;
 
ret = usb_control_msg(usbdev, usb_rcvctrlpipe(usbdev, 0),
  K90_REQUEST_STATUS,
@@ -330,16 +354,22 @@ static ssize_t k90_show_current_profile(
if (ret < 0) {
dev_warn(dev, "Failed to get K90 initial state (error %d).\n",
 ret);
-   return -EIO;
+   ret = -EIO;
+   goto out;
}
current_profile = data[7];
if (current_profile < 1 || current_profile > 3) {
dev_warn(dev, "Read invalid current profile: %02hhx.\n",
 data[7]);
-   return -EIO;
+   ret = -EIO;
+   goto out;
}
 
-   return snprintf(buf, PAGE_SIZE, "%d\n", current_profile);
+   ret = snprintf(buf, PAGE_SIZE, "%d\n", current_profile);
+out:
+   kfree(data);
+
+   return ret;
 }
 
 static ssize_t k90_store_current_profile(struct device *dev,