Commit 8431de80dad20979cc8354a90f70e2faac017932

Authored by Mayank Rana
Committed by Greg Kroah-Hartman
1 parent 7f97c000e8

msm_serial_hs: Fix type inconsistency for tx and rx command_ptr_ptr

Both tx and rx command_ptr_ptr are of type u32*. While allocating
memory for it, sizeof(u32 *) is used as part of kmalloc API instead
of sizeof(u32). ADM Hardare requires size of command_ptr_ptr as 1 Word.
Both sizeof(u32 *) and sizeof(u32) are same on 32-bit architecture
whereas sizeof(u32 *) would be different in size compare to sizeof(u32)
on anyother architecture.

Hence correct usage of sizeof(command_ptr_ptr) for Tx and Rx with
kmalloc and dma_(map/unmap)_single APIs.

Signed-off-by: Mayank Rana <mrana@codeaurora.org>
Reported-by: Ilia Mirkin <imirkin@alum.mit.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

Showing 1 changed file with 8 additions and 8 deletions Side-by-side Diff

drivers/tty/serial/msm_serial_hs.c
... ... @@ -422,9 +422,9 @@
422 422 msm_uport->rx.rbuffer);
423 423 dma_pool_destroy(msm_uport->rx.pool);
424 424  
425   - dma_unmap_single(dev, msm_uport->rx.cmdptr_dmaaddr, sizeof(u32 *),
  425 + dma_unmap_single(dev, msm_uport->rx.cmdptr_dmaaddr, sizeof(u32),
426 426 DMA_TO_DEVICE);
427   - dma_unmap_single(dev, msm_uport->tx.mapped_cmd_ptr_ptr, sizeof(u32 *),
  427 + dma_unmap_single(dev, msm_uport->tx.mapped_cmd_ptr_ptr, sizeof(u32),
428 428 DMA_TO_DEVICE);
429 429 dma_unmap_single(dev, msm_uport->tx.mapped_cmd_ptr, sizeof(dmov_box),
430 430 DMA_TO_DEVICE);
... ... @@ -812,7 +812,7 @@
812 812 *tx->command_ptr_ptr = CMD_PTR_LP | DMOV_CMD_ADDR(tx->mapped_cmd_ptr);
813 813  
814 814 dma_sync_single_for_device(uport->dev, tx->mapped_cmd_ptr_ptr,
815   - sizeof(u32 *), DMA_TO_DEVICE);
  815 + sizeof(u32), DMA_TO_DEVICE);
816 816  
817 817 /* Save tx_count to use in Callback */
818 818 tx->tx_count = tx_count;
... ... @@ -1537,7 +1537,7 @@
1537 1537 if (!tx->command_ptr)
1538 1538 return -ENOMEM;
1539 1539  
1540   - tx->command_ptr_ptr = kmalloc(sizeof(u32 *), GFP_KERNEL | __GFP_DMA);
  1540 + tx->command_ptr_ptr = kmalloc(sizeof(u32), GFP_KERNEL | __GFP_DMA);
1541 1541 if (!tx->command_ptr_ptr) {
1542 1542 ret = -ENOMEM;
1543 1543 goto err_tx_command_ptr_ptr;
... ... @@ -1547,7 +1547,7 @@
1547 1547 sizeof(dmov_box), DMA_TO_DEVICE);
1548 1548 tx->mapped_cmd_ptr_ptr = dma_map_single(uport->dev,
1549 1549 tx->command_ptr_ptr,
1550   - sizeof(u32 *), DMA_TO_DEVICE);
  1550 + sizeof(u32), DMA_TO_DEVICE);
1551 1551 tx->xfer.cmdptr = DMOV_CMD_ADDR(tx->mapped_cmd_ptr_ptr);
1552 1552  
1553 1553 init_waitqueue_head(&rx->wait);
... ... @@ -1575,7 +1575,7 @@
1575 1575 goto err_rx_command_ptr;
1576 1576 }
1577 1577  
1578   - rx->command_ptr_ptr = kmalloc(sizeof(u32 *), GFP_KERNEL | __GFP_DMA);
  1578 + rx->command_ptr_ptr = kmalloc(sizeof(u32), GFP_KERNEL | __GFP_DMA);
1579 1579 if (!rx->command_ptr_ptr) {
1580 1580 pr_err("%s(): cannot allocate rx->command_ptr_ptr", __func__);
1581 1581 ret = -ENOMEM;
... ... @@ -1593,7 +1593,7 @@
1593 1593 *rx->command_ptr_ptr = CMD_PTR_LP | DMOV_CMD_ADDR(rx->mapped_cmd_ptr);
1594 1594  
1595 1595 rx->cmdptr_dmaaddr = dma_map_single(uport->dev, rx->command_ptr_ptr,
1596   - sizeof(u32 *), DMA_TO_DEVICE);
  1596 + sizeof(u32), DMA_TO_DEVICE);
1597 1597 rx->xfer.cmdptr = DMOV_CMD_ADDR(rx->cmdptr_dmaaddr);
1598 1598  
1599 1599 INIT_WORK(&rx->tty_work, msm_hs_tty_flip_buffer_work);
... ... @@ -1609,7 +1609,7 @@
1609 1609 dma_pool_destroy(msm_uport->rx.pool);
1610 1610 err_dma_pool_create:
1611 1611 dma_unmap_single(uport->dev, msm_uport->tx.mapped_cmd_ptr_ptr,
1612   - sizeof(u32 *), DMA_TO_DEVICE);
  1612 + sizeof(u32), DMA_TO_DEVICE);
1613 1613 dma_unmap_single(uport->dev, msm_uport->tx.mapped_cmd_ptr,
1614 1614 sizeof(dmov_box), DMA_TO_DEVICE);
1615 1615 kfree(msm_uport->tx.command_ptr_ptr);