zd1211rw: Use DMA-aware buffer for usb transfer

The zd1211rw driver uses unaligned stack buffer for USB control
message.  But it might cause stack corruption on non-coherent
platform, such as MIPS.  Use DMA-aware buffers for USB transfer.

Signed-off-by: Atsushi Nemoto <anemo@mba.ocn.ne.jp>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

diff --git a/drivers/net/wireless/zd1211rw/zd_usb.c b/drivers/net/wireless/zd1211rw/zd_usb.c
index c8a0b34aecc8bc514f764a1ea8f53cab275e4039..6a51ae419e6f88a422248fcb7f5efa01bad314c7 100644 (file)
--- a/drivers/net/wireless/zd1211rw/zd_usb.c
+++ b/drivers/net/wireless/zd1211rw/zd_usb.c
@@ -169,10 +169,11 @@ static int upload_code(struct usb_device *udev,
        if (flags & REBOOT) {
                u8 ret;
 
+               /* Use "DMA-aware" buffer. */
                r = usb_control_msg(udev, usb_rcvctrlpipe(udev, 0),
                        USB_REQ_FIRMWARE_CONFIRM,
                        USB_DIR_IN | USB_TYPE_VENDOR,
-                       0, 0, &ret, sizeof(ret), 5000 /* ms */);
+                       0, 0, p, sizeof(ret), 5000 /* ms */);
                if (r != sizeof(ret)) {
                        dev_err(&udev->dev,
                                "control request firmeware confirmation failed."
@@ -181,6 +182,7 @@ static int upload_code(struct usb_device *udev,
                                r = -ENODEV;
                        goto error;
                }
+               ret = p[0];
                if (ret & 0x80) {
                        dev_err(&udev->dev,
                                "Internal error while downloading."
@@ -312,22 +314,31 @@ int zd_usb_read_fw(struct zd_usb *usb, zd_addr_t addr, u8 *data, u16 len)
 {
        int r;
        struct usb_device *udev = zd_usb_to_usbdev(usb);
+       u8 *buf;
 
+       /* Use "DMA-aware" buffer. */
+       buf = kmalloc(len, GFP_KERNEL);
+       if (!buf)
+               return -ENOMEM;
        r = usb_control_msg(udev, usb_rcvctrlpipe(udev, 0),
                USB_REQ_FIRMWARE_READ_DATA, USB_DIR_IN | 0x40, addr, 0,
-               data, len, 5000);
+               buf, len, 5000);
        if (r < 0) {
                dev_err(&udev->dev,
                        "read over firmware interface failed: %d\n", r);
-               return r;
+               goto exit;
        } else if (r != len) {
                dev_err(&udev->dev,
                        "incomplete read over firmware interface: %d/%d\n",
                        r, len);
-               return -EIO;
+               r = -EIO;
+               goto exit;
        }
-
-       return 0;
+       r = 0;
+       memcpy(data, buf, len);
+exit:
+       kfree(buf);
+       return r;
 }
 
 #define urb_dev(urb) (&(urb)->dev->dev)