]> git.ipfire.org Git - thirdparty/linux.git/commitdiff
media: rc: igorplugusb: heed coherency rules
authorOliver Neukum <oneukum@suse.com>
Wed, 11 Feb 2026 18:11:51 +0000 (19:11 +0100)
committerHans Verkuil <hverkuil+cisco@kernel.org>
Tue, 17 Mar 2026 13:43:57 +0000 (14:43 +0100)
In a control request, the USB request structure
can be subject to DMA on some HCs. Hence it must obey
the rules for DMA coherency. Allocate it separately.

Fixes: b1c97193c6437 ("[media] rc: port IgorPlug-USB to rc-core")
Cc: stable@vger.kernel.org
Signed-off-by: Oliver Neukum <oneukum@suse.com>
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
drivers/media/rc/igorplugusb.c

index 5ceb5ca44e23579dfbbb4b6d9ce6b5281a648470..3e10f6fe89f83c76e5a21222955122ab850376a4 100644 (file)
@@ -34,7 +34,7 @@ struct igorplugusb {
        struct device *dev;
 
        struct urb *urb;
-       struct usb_ctrlrequest request;
+       struct usb_ctrlrequest *request;
 
        struct timer_list timer;
 
@@ -122,7 +122,7 @@ static void igorplugusb_cmd(struct igorplugusb *ir, int cmd)
 {
        int ret;
 
-       ir->request.bRequest = cmd;
+       ir->request->bRequest = cmd;
        ir->urb->transfer_flags = 0;
        ret = usb_submit_urb(ir->urb, GFP_ATOMIC);
        if (ret && ret != -EPERM)
@@ -164,13 +164,17 @@ static int igorplugusb_probe(struct usb_interface *intf,
        if (!ir)
                return -ENOMEM;
 
+       ir->request = kzalloc_obj(*ir->request, GFP_KERNEL);
+       if (!ir->request)
+               goto fail;
+
        ir->dev = &intf->dev;
 
        timer_setup(&ir->timer, igorplugusb_timer, 0);
 
-       ir->request.bRequest = GET_INFRACODE;
-       ir->request.bRequestType = USB_TYPE_VENDOR | USB_DIR_IN;
-       ir->request.wLength = cpu_to_le16(MAX_PACKET);
+       ir->request->bRequest = GET_INFRACODE;
+       ir->request->bRequestType = USB_TYPE_VENDOR | USB_DIR_IN;
+       ir->request->wLength = cpu_to_le16(MAX_PACKET);
 
        ir->urb = usb_alloc_urb(0, GFP_KERNEL);
        if (!ir->urb)
@@ -228,6 +232,7 @@ fail:
        usb_free_urb(ir->urb);
        rc_free_device(ir->rc);
        kfree(ir->buf_in);
+       kfree(ir->request);
 
        return ret;
 }
@@ -244,6 +249,7 @@ static void igorplugusb_disconnect(struct usb_interface *intf)
        usb_free_urb(ir->urb);
        rc_free_device(ir->rc);
        kfree(ir->buf_in);
+       kfree(ir->request);
 }
 
 static const struct usb_device_id igorplugusb_table[] = {