mfd: cros_ec: Use a zero-length array for command data

Commit 1b84f2a4cd4a ("mfd: cros_ec: Use fixed size arrays to transfer
data with the EC") modified the struct cros_ec_command fields to not
use pointers for the input and output buffers and use fixed length
arrays instead.

This change was made because the cros_ec ioctl API uses that struct
cros_ec_command to allow user-space to send commands to the EC and
to get data from the EC. So using pointers made the API not 64-bit
safe. Unfortunately this approach was not flexible enough for all
the use-cases since there may be a need to send larger commands
on newer versions of the EC command protocol.

So to avoid to choose a constant length that it may be too big for
most commands and thus wasting memory and CPU cycles on copy from
and to user-space or having a size that is too small for some big
commands, use a zero-length array that is both 64-bit safe and
flexible. The same buffer is used for both output and input data
so the maximum of these values should be used to allocate it.

Suggested-by: Gwendal Grignou <gwendal@chromium.org>
Signed-off-by: Javier Martinez Canillas <javier.martinez@collabora.co.uk>
Tested-by: Heiko Stuebner <heiko@sntech.de>
Acked-by: Lee Jones <lee.jones@linaro.org>
Acked-by: Olof Johansson <olof@lixom.net>
Signed-off-by: Lee Jones <lee.jones@linaro.org>

1 files changed, 30 insertions, 15 deletions

diff --git a/drivers/i2c/busses/i2c-cros-ec-tunnel.c b/drivers/i2c/busses/i2c-cros-ec-tunnel.c
index fa8dedd8c3a2..a0d95ff682ae 100644
--- a/drivers/i2c/busses/i2c-cros-ec-tunnel.c
+++ b/drivers/i2c/busses/i2c-cros-ec-tunnel.c
@@ -182,8 +182,9 @@ static int ec_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg i2c_msgs[],
         const u16 bus_num = bus->remote_bus;
         int request_len;
         int response_len;
+        int alloc_size;
         int result;
-        struct cros_ec_command msg = { };
+        struct cros_ec_command *msg;
 
         request_len = ec_i2c_count_message(i2c_msgs, num);
         if (request_len < 0) {
@@ -198,25 +199,39 @@ static int ec_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg i2c_msgs[],
                 return response_len;
         }
 
-        result = ec_i2c_construct_message(msg.outdata, i2c_msgs, num, bus_num);
-        if (result)
-                return result;
+        alloc_size = max(request_len, response_len);
+        msg = kmalloc(sizeof(*msg) + alloc_size, GFP_KERNEL);
+        if (!msg)
+                return -ENOMEM;
 
-        msg.version = 0;
-        msg.command = EC_CMD_I2C_PASSTHRU;
-        msg.outsize = request_len;
-        msg.insize = response_len;
+        result = ec_i2c_construct_message(msg->data, i2c_msgs, num, bus_num);
+        if (result) {
+                dev_err(dev, "Error constructing EC i2c message %d\n", result);
+                goto exit;
+        }
 
-        result = cros_ec_cmd_xfer(bus->ec, &msg);
-        if (result < 0)
-                return result;
+        msg->version = 0;
+        msg->command = EC_CMD_I2C_PASSTHRU;
+        msg->outsize = request_len;
+        msg->insize = response_len;
 
-        result = ec_i2c_parse_response(msg.indata, i2c_msgs, &num);
-        if (result < 0)
-                return result;
+        result = cros_ec_cmd_xfer(bus->ec, msg);
+        if (result < 0) {
+                dev_err(dev, "Error transferring EC i2c message %d\n", result);
+                goto exit;
+        }
+
+        result = ec_i2c_parse_response(msg->data, i2c_msgs, &num);
+        if (result < 0) {
+                dev_err(dev, "Error parsing EC i2c message %d\n", result);
+                goto exit;
+        }
 
         /* Indicate success by saying how many messages were sent */
-        return num;
+        result = num;
+exit:
+        kfree(msg);
+        return result;
 }
 
 static u32 ec_i2c_functionality(struct i2c_adapter *adap)