[PATCH v2 6/6] USB gadget: Fix dma memory allocations

[Marc Kleine-Budde]

From: Sascha Hauer <s.hauer at pengutronix.de>

This is another variant of:

    USB gadget fsl: request cacheline aligned buffer

    The fsl udc driver allocates a buffer for small requests. The
    driver then calls dma_inv_range later on it. This buffer happens
    to be not cacheline aligned which means that a dma_inv_range can
    corrupt other memory around the buffer.

Signed-off-by: Sascha Hauer <s.hauer at pengutronix.de>
[mkl: use dma_alloc]
Signed-off-by: Marc Kleine-Budde <mkl at pengutronix.de>
---
 drivers/usb/gadget/composite.c |    5 +++--
 drivers/usb/gadget/dfu.c       |    5 +++--
 2 files changed, 6 insertions(+), 4 deletions(-)

diff --git a/drivers/usb/gadget/composite.c b/drivers/usb/gadget/composite.c
index fd70e62..44e58d7 100644
--- a/drivers/usb/gadget/composite.c
+++ b/drivers/usb/gadget/composite.c
@@ -22,6 +22,7 @@
 
 #include <common.h>
 #include <errno.h>
+#include <dma.h>
 #include <usb/composite.h>
 #include <asm/byteorder.h>
 
@@ -867,7 +868,7 @@ composite_unbind(struct usb_gadget *gadget)
 		composite->unbind(cdev);
 
 	if (cdev->req) {
-		kfree(cdev->req->buf);
+		dma_free(cdev->req->buf);
 		usb_ep_free_request(gadget->ep0, cdev->req);
 	}
 	kfree(cdev);
@@ -911,7 +912,7 @@ static int __init composite_bind(struct usb_gadget *gadget)
 	cdev->req = usb_ep_alloc_request(gadget->ep0);
 	if (!cdev->req)
 		goto fail;
-	cdev->req->buf = malloc(USB_BUFSIZ);
+	cdev->req->buf = dma_alloc(USB_BUFSIZ);
 	if (!cdev->req->buf)
 		goto fail;
 	cdev->req->complete = composite_setup_complete;
diff --git a/drivers/usb/gadget/dfu.c b/drivers/usb/gadget/dfu.c
index f26c1e4..e205c65 100644
--- a/drivers/usb/gadget/dfu.c
+++ b/drivers/usb/gadget/dfu.c
@@ -40,6 +40,7 @@
  * - make 'dnstate' attached to 'struct usb_device_instance'
  */
 
+#include <dma.h>
 #include <asm/byteorder.h>
 #include <usb/composite.h>
 #include <linux/types.h>
@@ -183,7 +184,7 @@ dfu_unbind(struct usb_configuration *c, struct usb_function *f)
 	if (gadget_is_dualspeed(c->cdev->gadget))
 		free(f->hs_descriptors);
 
-	free(dfu->dnreq->buf);
+	dma_free(dfu->dnreq->buf);
 	usb_ep_free_request(c->cdev->gadget->ep0, dfu->dnreq);
 	free(dfu);
 }
@@ -602,7 +603,7 @@ static int dfu_bind_config(struct usb_configuration *c)
 	dfu->dnreq = usb_ep_alloc_request(c->cdev->gadget->ep0);
 	if (!dfu->dnreq)
 		printf("usb_ep_alloc_request failed\n");
-	dfu->dnreq->buf = xmalloc(CONFIG_USBD_DFU_XFER_SIZE);
+	dfu->dnreq->buf = dma_alloc(CONFIG_USBD_DFU_XFER_SIZE);
 	dfu->dnreq->complete = dn_complete;
 	dfu->dnreq->zero = 0;
 
-- 
1.7.10