target/linux/brcm2708/patches-4.19/950-0206-Mailbox-firmware-calls-now-use-kmalloc-2749.patch

   1 From 3090cdd55e3a36f545409814cbee08761b93640c Mon Sep 17 00:00:00 2001
   2 From: James Hughes <JamesH65@users.noreply.github.com>
   3 Date: Tue, 13 Nov 2018 17:27:00 +0000
   4 Subject: [PATCH 206/703] Mailbox firmware calls now use kmalloc (#2749)
   5
   6 A previous change moved away from variable stack
   7 allocation of a data buffer to a fixed maximum size.
   8 However, some mailbox calls use larger data buffers
   9 than the maximum allowed. This change moves from
  10 stack storage to kmalloc to ensure all sizes are
  11 catered for.
  12
  13 Signed-off-by: James Hughes <james.hughes@raspberrypi.org>
  14 ---
  15  drivers/firmware/raspberrypi.c | 35 +++++++++++++++++-----------------
  16  1 file changed, 18 insertions(+), 17 deletions(-)
  17
  18 --- a/drivers/firmware/raspberrypi.c
  19 +++ b/drivers/firmware/raspberrypi.c
  20 @@ -15,6 +15,7 @@
  21  #include <linux/of_platform.h>
  22  #include <linux/platform_device.h>
  23  #include <linux/reboot.h>
  24 +#include <linux/slab.h>
  25  #include <soc/bcm2835/raspberrypi-firmware.h>
  26
  27  #define MBOX_MSG(chan, data28)         (((data28) & ~0xf) | ((chan) & 0xf))
  28 @@ -22,8 +23,6 @@
  29  #define MBOX_DATA28(msg)               ((msg) & ~0xf)
  30  #define MBOX_CHAN_PROPERTY             8
  31
  32 -#define MAX_RPI_FW_PROP_BUF_SIZE       48
  33 -
  34  static struct platform_device *rpi_hwmon;
  35
  36  struct rpi_firmware {
  37 @@ -149,28 +148,28 @@ EXPORT_SYMBOL_GPL(rpi_firmware_property_
  38  int rpi_firmware_property(struct rpi_firmware *fw,
  39                           u32 tag, void *tag_data, size_t buf_size)
  40  {
  41 -       /* Single tags are very small (generally 8 bytes), so the
  42 -        * stack should be safe.
  43 -        */
  44 -       u8 data[sizeof(struct rpi_firmware_property_tag_header) +
  45 -               MAX_RPI_FW_PROP_BUF_SIZE];
  46 -       struct rpi_firmware_property_tag_header *header =
  47 -               (struct rpi_firmware_property_tag_header *)data;
  48         int ret;
  49 +       struct rpi_firmware_property_tag_header *header;
  50
  51 -       if (WARN_ON(buf_size > sizeof(data) - sizeof(*header)))
  52 -               return -EINVAL;
  53 +       /* Some mailboxes can use over 1k bytes. Rather than checking
  54 +        * size and using stack or kmalloc depending on requirements,
  55 +        * just use kmalloc. Mailboxes don't get called enough to worry
  56 +        * too much about the time taken in the allocation.
  57 +        */
  58 +       void *data = kmalloc(sizeof(*header) + buf_size, GFP_KERNEL);
  59
  60 +       if (!data)
  61 +               return -ENOMEM;
  62 +
  63 +       header = data;
  64         header->tag = tag;
  65         header->buf_size = buf_size;
  66         header->req_resp_size = 0;
  67 -       memcpy(data + sizeof(struct rpi_firmware_property_tag_header),
  68 -              tag_data, buf_size);
  69 +       memcpy(data + sizeof(*header), tag_data, buf_size);
  70
  71 -       ret = rpi_firmware_property_list(fw, &data, buf_size + sizeof(*header));
  72 -       memcpy(tag_data,
  73 -              data + sizeof(struct rpi_firmware_property_tag_header),
  74 -              buf_size);
  75 +       ret = rpi_firmware_property_list(fw, data, buf_size + sizeof(*header));
  76 +
  77 +       memcpy(tag_data, data + sizeof(*header), buf_size);
  78
  79         if ((tag == RPI_FIRMWARE_GET_THROTTLED) &&
  80              memcmp(&fw->get_throttled, tag_data, sizeof(fw->get_throttled))) {
  81 @@ -178,6 +177,8 @@ int rpi_firmware_property(struct rpi_fir
  82                 sysfs_notify(&fw->cl.dev->kobj, NULL, "get_throttled");
  83         }
  84
  85 +       kfree(data);
  86 +
  87         return ret;
  88  }
  89  EXPORT_SYMBOL_GPL(rpi_firmware_property);