usb: host: max3421-hcd: fix "spi_rd8" uses dynamic stack allocation warning

kmalloc the SPI rx and tx data buffers.  This appears to be the only
portable way to guarantee that the buffers are DMA-safe (e.g., in
separate DMA cache-lines).  This patch makes the spi_rdX()/spi_wrX()
non-reentrant, but that's OK because calls to them are guaranteed to
be serialized by the per-HCD SPI-thread.

Reported-by: kbuild test robot <fengguang.wu@intel.com>
Signed-off-by: David Mosberger <davidm@egauge.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

1 files changed, 60 insertions, 34 deletions

diff --git a/drivers/usb/host/max3421-hcd.c b/drivers/usb/host/max3421-hcd.c
index 714f99faa14a..ccb1bc42b4d2 100644
--- a/drivers/usb/host/max3421-hcd.c
+++ b/drivers/usb/host/max3421-hcd.c
@@ -102,6 +102,10 @@ enum scheduling_pass {
 	SCHED_PASS_DONE
 };
 
+struct max3421_dma_buf {
+	u8 data[2];
+};
+
 struct max3421_hcd {
 	spinlock_t lock;
 
@@ -124,6 +128,12 @@ struct max3421_hcd {
 	u8 rev;				/* chip revision */
 	u16 frame_number;
 	/*
+	 * kmalloc'd buffers guaranteed to be in separate (DMA)
+	 * cache-lines:
+	 */
+	struct max3421_dma_buf *tx;
+	struct max3421_dma_buf *rx;
+	/*
 	 * URB we're currently processing.  Must not be reset to NULL
 	 * unless MAX3421E chip is idle:
 	 */
@@ -332,51 +342,47 @@ max3421_to_hcd(struct max3421_hcd *max3421_hcd)
 static u8
 spi_rd8(struct usb_hcd *hcd, unsigned int reg)
 {
+	struct max3421_hcd *max3421_hcd = hcd_to_max3421(hcd);
 	struct spi_device *spi = to_spi_device(hcd->self.controller);
 	struct spi_transfer transfer;
-	u8 tx_data[1];
-	/*
-	 * RX data must be in its own cache-line so it stays flushed
-	 * from the cache until the transfer is complete.  Otherwise,
-	 * we get stale data from the cache.
-	 */
-	u8 rx_data[SMP_CACHE_BYTES] ____cacheline_aligned;
 	struct spi_message msg;
 
 	memset(&transfer, 0, sizeof(transfer));
 
 	spi_message_init(&msg);
 
-	tx_data[0] = (field(reg, MAX3421_SPI_REG_SHIFT) |
-		      field(MAX3421_SPI_DIR_RD, MAX3421_SPI_DIR_SHIFT));
+	max3421_hcd->tx->data[0] =
+		(field(reg, MAX3421_SPI_REG_SHIFT) |
+		 field(MAX3421_SPI_DIR_RD, MAX3421_SPI_DIR_SHIFT));
 
-	transfer.tx_buf = tx_data;
-	transfer.rx_buf = rx_data;
+	transfer.tx_buf = max3421_hcd->tx->data;
+	transfer.rx_buf = max3421_hcd->rx->data;
 	transfer.len = 2;
 
 	spi_message_add_tail(&transfer, &msg);
 	spi_sync(spi, &msg);
 
-	return rx_data[1];
+	return max3421_hcd->rx->data[1];
 }
 
 static void
 spi_wr8(struct usb_hcd *hcd, unsigned int reg, u8 val)
 {
 	struct spi_device *spi = to_spi_device(hcd->self.controller);
+	struct max3421_hcd *max3421_hcd = hcd_to_max3421(hcd);
 	struct spi_transfer transfer;
 	struct spi_message msg;
-	u8 tx_data[2];
 
 	memset(&transfer, 0, sizeof(transfer));
 
 	spi_message_init(&msg);
 
-	tx_data[0] = (field(reg, MAX3421_SPI_REG_SHIFT) |
-		      field(MAX3421_SPI_DIR_WR, MAX3421_SPI_DIR_SHIFT));
-	tx_data[1] = val;
+	max3421_hcd->tx->data[0] =
+		(field(reg, MAX3421_SPI_REG_SHIFT) |
+		 field(MAX3421_SPI_DIR_WR, MAX3421_SPI_DIR_SHIFT));
+	max3421_hcd->tx->data[1] = val;
 
-	transfer.tx_buf = tx_data;
+	transfer.tx_buf = max3421_hcd->tx->data;
 	transfer.len = 2;
 
 	spi_message_add_tail(&transfer, &msg);
@@ -387,18 +393,18 @@ static void
 spi_rd_buf(struct usb_hcd *hcd, unsigned int reg, void *buf, size_t len)
 {
 	struct spi_device *spi = to_spi_device(hcd->self.controller);
+	struct max3421_hcd *max3421_hcd = hcd_to_max3421(hcd);
 	struct spi_transfer transfer[2];
 	struct spi_message msg;
-	u8 cmd;
 
 	memset(transfer, 0, sizeof(transfer));
 
 	spi_message_init(&msg);
 
-	cmd = (field(reg, MAX3421_SPI_REG_SHIFT) |
-	       field(MAX3421_SPI_DIR_RD, MAX3421_SPI_DIR_SHIFT));
-
-	transfer[0].tx_buf = &cmd;
+	max3421_hcd->tx->data[0] =
+		(field(reg, MAX3421_SPI_REG_SHIFT) |
+		 field(MAX3421_SPI_DIR_RD, MAX3421_SPI_DIR_SHIFT));
+	transfer[0].tx_buf = max3421_hcd->tx->data;
 	transfer[0].len = 1;
 
 	transfer[1].rx_buf = buf;
@@ -413,18 +419,19 @@ static void
 spi_wr_buf(struct usb_hcd *hcd, unsigned int reg, void *buf, size_t len)
 {
 	struct spi_device *spi = to_spi_device(hcd->self.controller);
+	struct max3421_hcd *max3421_hcd = hcd_to_max3421(hcd);
 	struct spi_transfer transfer[2];
 	struct spi_message msg;
-	u8 cmd;
 
 	memset(transfer, 0, sizeof(transfer));
 
 	spi_message_init(&msg);
 
-	cmd = (field(reg, MAX3421_SPI_REG_SHIFT) |
-	       field(MAX3421_SPI_DIR_WR, MAX3421_SPI_DIR_SHIFT));
+	max3421_hcd->tx->data[0] =
+		(field(reg, MAX3421_SPI_REG_SHIFT) |
+		 field(MAX3421_SPI_DIR_WR, MAX3421_SPI_DIR_SHIFT));
 
-	transfer[0].tx_buf = &cmd;
+	transfer[0].tx_buf = max3421_hcd->tx->data;
 	transfer[0].len = 1;
 
 	transfer[1].tx_buf = buf;
@@ -1834,8 +1841,8 @@ static int
 max3421_probe(struct spi_device *spi)
 {
 	struct max3421_hcd *max3421_hcd;
-	struct usb_hcd *hcd;
-	int retval;
+	struct usb_hcd *hcd = NULL;
+	int retval = -ENOMEM;
 
 	if (spi_setup(spi) < 0) {
 		dev_err(&spi->dev, "Unable to setup SPI bus");
@@ -1846,7 +1853,7 @@ max3421_probe(struct spi_device *spi)
 			     dev_name(&spi->dev));
 	if (!hcd) {
 		dev_err(&spi->dev, "failed to create HCD structure\n");
-		return -ENOMEM;
+		goto error;
 	}
 	set_bit(HCD_FLAG_POLL_RH, &hcd->flags);
 	max3421_hcd = hcd_to_max3421(hcd);
@@ -1854,29 +1861,48 @@ max3421_probe(struct spi_device *spi)
 	max3421_hcd_list = max3421_hcd;
 	INIT_LIST_HEAD(&max3421_hcd->ep_list);
 
+	max3421_hcd->tx = kmalloc(sizeof(*max3421_hcd->tx), GFP_KERNEL);
+	if (!max3421_hcd->tx) {
+		dev_err(&spi->dev, "failed to kmalloc tx buffer\n");
+		goto error;
+	}
+	max3421_hcd->rx = kmalloc(sizeof(*max3421_hcd->rx), GFP_KERNEL);
+	if (!max3421_hcd->rx) {
+		dev_err(&spi->dev, "failed to kmalloc rx buffer\n");
+		goto error;
+	}
+
 	max3421_hcd->spi_thread = kthread_run(max3421_spi_thread, hcd,
 					      "max3421_spi_thread");
 	if (max3421_hcd->spi_thread == ERR_PTR(-ENOMEM)) {
 		dev_err(&spi->dev,
 			"failed to create SPI thread (out of memory)\n");
-		return -ENOMEM;
+		goto error;
 	}
 
 	retval = usb_add_hcd(hcd, 0, 0);
 	if (retval) {
 		dev_err(&spi->dev, "failed to add HCD\n");
-		usb_put_hcd(hcd);
-		return retval;
+		goto error;
 	}
 
 	retval = request_irq(spi->irq, max3421_irq_handler,
 			     IRQF_TRIGGER_LOW, "max3421", hcd);
 	if (retval < 0) {
-		usb_put_hcd(hcd);
 		dev_err(&spi->dev, "failed to request irq %d\n", spi->irq);
-		return retval;
+		goto error;
 	}
 	return 0;
+
+error:
+	if (hcd) {
+		kfree(max3421_hcd->tx);
+		kfree(max3421_hcd->rx);
+		if (max3421_hcd->spi_thread)
+			kthread_stop(max3421_hcd->spi_thread);
+		usb_put_hcd(hcd);
+	}
+	return retval;
 }
 
 static int