Input: ims-pcu - fix DMA mapping violation in line setup

In ims_pcu_line_setup(), the driver uses pcu->cmd_buf as a transfer
buffer for usb_control_msg(). However, pcu->cmd_buf is embedded in the
struct ims_pcu allocation, which violates DMA mapping rules regarding
cacheline alignment.

Use a heap-allocated buffer for the line coding data instead.

Fixes: 628329d52474 ("Input: add IMS Passenger Control Unit driver")
Cc: stable@vger.kernel.org
Reported-by: Sashiko bot <sashiko-bot@kernel.org>
Assisted-by: Gemini:gemini-3.1-pro
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>

diff --git a/drivers/input/misc/ims-pcu.c b/drivers/input/misc/ims-pcu.c
index 6bacd7e56e68db05b6091390c83dad05730c29a7..371c605efcf43136f4b0305288003359a026a88f 100644 (file)
--- a/drivers/input/misc/ims-pcu.c
+++ b/drivers/input/misc/ims-pcu.c
@@ -1797,11 +1797,16 @@ static void ims_pcu_stop_io(struct ims_pcu *pcu)
 static int ims_pcu_line_setup(struct ims_pcu *pcu)
 {
        struct usb_host_interface *interface = pcu->ctrl_intf->cur_altsetting;
-       struct usb_cdc_line_coding *line = (void *)pcu->cmd_buf;
+       struct usb_cdc_line_coding *line __free(kfree) =
+                               kmalloc(sizeof(*line), GFP_KERNEL);
        int error;
 
-       memset(line, 0, sizeof(*line));
+       if (!line)
+               return -ENOMEM;
+
        line->dwDTERate = cpu_to_le32(57600);
+       line->bCharFormat = USB_CDC_1_STOP_BITS;
+       line->bParityType = USB_CDC_NO_PARITY;
        line->bDataBits = 8;
 
        error = usb_control_msg(pcu->udev, usb_sndctrlpipe(pcu->udev, 0),