mfd: cros_ec: Use a zero-length array for command data

Commit 1b84f2a4cd4a ("mfd: cros_ec: Use fixed size arrays to transfer
data with the EC") modified the struct cros_ec_command fields to not
use pointers for the input and output buffers and use fixed length
arrays instead.

This change was made because the cros_ec ioctl API uses that struct
cros_ec_command to allow user-space to send commands to the EC and
to get data from the EC. So using pointers made the API not 64-bit
safe. Unfortunately this approach was not flexible enough for all
the use-cases since there may be a need to send larger commands
on newer versions of the EC command protocol.

So to avoid to choose a constant length that it may be too big for
most commands and thus wasting memory and CPU cycles on copy from
and to user-space or having a size that is too small for some big
commands, use a zero-length array that is both 64-bit safe and
flexible. The same buffer is used for both output and input data
so the maximum of these values should be used to allocate it.

Suggested-by: Gwendal Grignou <gwendal@chromium.org>
Signed-off-by: Javier Martinez Canillas <javier.martinez@collabora.co.uk>
Tested-by: Heiko Stuebner <heiko@sntech.de>
Acked-by: Lee Jones <lee.jones@linaro.org>
Acked-by: Olof Johansson <olof@lixom.net>
Signed-off-by: Lee Jones <lee.jones@linaro.org>

4 files changed, 244 insertions, 135 deletions

diff --git a/drivers/platform/chrome/cros_ec_dev.c b/drivers/platform/chrome/cros_ec_dev.c
index 6090d0b2826f..e91ced1cb8ce 100644
--- a/drivers/platform/chrome/cros_ec_dev.c
+++ b/drivers/platform/chrome/cros_ec_dev.c
@@ -20,6 +20,7 @@
 #include <linux/fs.h>
 #include <linux/module.h>
 #include <linux/platform_device.h>
+#include <linux/slab.h>
 #include <linux/uaccess.h>
 
 #include "cros_ec_dev.h"
@@ -36,28 +37,31 @@ static int ec_get_version(struct cros_ec_device *ec, char *str, int maxlen)
         static const char * const current_image_name[] = {
                 "unknown", "read-only", "read-write", "invalid",
         };
-        struct cros_ec_command msg = {
-                .version = 0,
-                .command = EC_CMD_GET_VERSION,
-                .outdata = { 0 },
-                .outsize = 0,
-                .indata = { 0 },
-                .insize = sizeof(*resp),
-        };
+        struct cros_ec_command *msg;
         int ret;
 
-        ret = cros_ec_cmd_xfer(ec, &msg);
+        msg = kmalloc(sizeof(*msg) + sizeof(*resp), GFP_KERNEL);
+        if (!msg)
+                return -ENOMEM;
+
+        msg->version = 0;
+        msg->command = EC_CMD_GET_VERSION;
+        msg->insize = sizeof(*resp);
+        msg->outsize = 0;
+
+        ret = cros_ec_cmd_xfer(ec, msg);
         if (ret < 0)
-                return ret;
+                goto exit;
 
-        if (msg.result != EC_RES_SUCCESS) {
+        if (msg->result != EC_RES_SUCCESS) {
                 snprintf(str, maxlen,
                          "%s\nUnknown EC version: EC returned %d\n",
-                         CROS_EC_DEV_VERSION, msg.result);
-                return 0;
+                         CROS_EC_DEV_VERSION, msg->result);
+                ret = -EINVAL;
+                goto exit;
         }
 
-        resp = (struct ec_response_get_version *)msg.indata;
+        resp = (struct ec_response_get_version *)msg->data;
         if (resp->current_image >= ARRAY_SIZE(current_image_name))
                 resp->current_image = 3; /* invalid */
 
@@ -65,7 +69,10 @@ static int ec_get_version(struct cros_ec_device *ec, char *str, int maxlen)
                  resp->version_string_ro, resp->version_string_rw,
                  current_image_name[resp->current_image]);
 
-        return 0;
+        ret = 0;
+exit:
+        kfree(msg);
+        return ret;
 }
 
 /* Device file ops */
@@ -110,20 +117,32 @@ static ssize_t ec_device_read(struct file *filp, char __user *buffer,
 static long ec_device_ioctl_xcmd(struct cros_ec_device *ec, void __user *arg)
 {
         long ret;
-        struct cros_ec_command s_cmd = { };
+        struct cros_ec_command u_cmd;
+        struct cros_ec_command *s_cmd;
 
-        if (copy_from_user(&s_cmd, arg, sizeof(s_cmd)))
+        if (copy_from_user(&u_cmd, arg, sizeof(u_cmd)))
                 return -EFAULT;
 
-        ret = cros_ec_cmd_xfer(ec, &s_cmd);
+        s_cmd = kmalloc(sizeof(*s_cmd) + max(u_cmd.outsize, u_cmd.insize),
+                        GFP_KERNEL);
+        if (!s_cmd)
+                return -ENOMEM;
+
+        if (copy_from_user(s_cmd, arg, sizeof(*s_cmd) + u_cmd.outsize)) {
+                ret = -EFAULT;
+                goto exit;
+        }
+
+        ret = cros_ec_cmd_xfer(ec, s_cmd);
         /* Only copy data to userland if data was received. */
         if (ret < 0)
-                return ret;
+                goto exit;
 
-        if (copy_to_user(arg, &s_cmd, sizeof(s_cmd)))
-                return -EFAULT;
-
-        return 0;
+        if (copy_to_user(arg, s_cmd, sizeof(*s_cmd) + u_cmd.insize))
+                ret = -EFAULT;
+exit:
+        kfree(s_cmd);
+        return ret;
 }
 
 static long ec_device_ioctl_readmem(struct cros_ec_device *ec, void __user *arg)
diff --git a/drivers/platform/chrome/cros_ec_lightbar.c b/drivers/platform/chrome/cros_ec_lightbar.c
index b4ff47a9069a..560e5d41b7ae 100644
--- a/drivers/platform/chrome/cros_ec_lightbar.c
+++ b/drivers/platform/chrome/cros_ec_lightbar.c
@@ -31,6 +31,7 @@
 #include <linux/sched.h>
 #include <linux/types.h>
 #include <linux/uaccess.h>
+#include <linux/slab.h>
 
 #include "cros_ec_dev.h"
 
@@ -91,54 +92,79 @@ out:
         return ret;
 }
 
-#define INIT_MSG(P, R) { \
-                .command = EC_CMD_LIGHTBAR_CMD, \
-                .outsize = sizeof(*P), \
-                .insize = sizeof(*R), \
-        }
+static struct cros_ec_command *alloc_lightbar_cmd_msg(void)
+{
+        struct cros_ec_command *msg;
+        int len;
+
+        len = max(sizeof(struct ec_params_lightbar),
+                  sizeof(struct ec_response_lightbar));
+
+        msg = kmalloc(sizeof(*msg) + len, GFP_KERNEL);
+        if (!msg)
+                return NULL;
+
+        msg->version = 0;
+        msg->command = EC_CMD_LIGHTBAR_CMD;
+        msg->outsize = sizeof(struct ec_params_lightbar);
+        msg->insize = sizeof(struct ec_response_lightbar);
+
+        return msg;
+}
 
 static int get_lightbar_version(struct cros_ec_device *ec,
                                 uint32_t *ver_ptr, uint32_t *flg_ptr)
 {
         struct ec_params_lightbar *param;
         struct ec_response_lightbar *resp;
-        struct cros_ec_command msg = INIT_MSG(param, resp);
+        struct cros_ec_command *msg;
         int ret;
 
-        param = (struct ec_params_lightbar *)msg.outdata;
-        param->cmd = LIGHTBAR_CMD_VERSION;
-        ret = cros_ec_cmd_xfer(ec, &msg);
-        if (ret < 0)
+        msg = alloc_lightbar_cmd_msg();
+        if (!msg)
                 return 0;
 
-        switch (msg.result) {
+        param = (struct ec_params_lightbar *)msg->data;
+        param->cmd = LIGHTBAR_CMD_VERSION;
+        ret = cros_ec_cmd_xfer(ec, msg);
+        if (ret < 0) {
+                ret = 0;
+                goto exit;
+        }
+
+        switch (msg->result) {
         case EC_RES_INVALID_PARAM:
                 /* Pixel had no version command. */
                 if (ver_ptr)
                         *ver_ptr = 0;
                 if (flg_ptr)
                         *flg_ptr = 0;
-                return 1;
+                ret = 1;
+                goto exit;
 
         case EC_RES_SUCCESS:
-                resp = (struct ec_response_lightbar *)msg.indata;
+                resp = (struct ec_response_lightbar *)msg->data;
 
                 /* Future devices w/lightbars should implement this command */
                 if (ver_ptr)
                         *ver_ptr = resp->version.num;
                 if (flg_ptr)
                         *flg_ptr = resp->version.flags;
-                return 1;
+                ret = 1;
+                goto exit;
         }
 
         /* Anything else (ie, EC_RES_INVALID_COMMAND) - no lightbar */
-        return 0;
+        ret = 0;
+exit:
+        kfree(msg);
+        return ret;
 }
 
 static ssize_t version_show(struct device *dev,
                             struct device_attribute *attr, char *buf)
 {
-        uint32_t version, flags;
+        uint32_t version = 0, flags = 0;
         struct cros_ec_device *ec = dev_get_drvdata(dev);
         int ret;
 
@@ -158,8 +184,7 @@ static ssize_t brightness_store(struct device *dev,
                                 const char *buf, size_t count)
 {
         struct ec_params_lightbar *param;
-        struct ec_response_lightbar *resp;
-        struct cros_ec_command msg = INIT_MSG(param, resp);
+        struct cros_ec_command *msg;
         int ret;
         unsigned int val;
         struct cros_ec_device *ec = dev_get_drvdata(dev);
@@ -167,21 +192,30 @@ static ssize_t brightness_store(struct device *dev,
         if (kstrtouint(buf, 0, &val))
                 return -EINVAL;
 
-        param = (struct ec_params_lightbar *)msg.outdata;
+        msg = alloc_lightbar_cmd_msg();
+        if (!msg)
+                return -ENOMEM;
+
+        param = (struct ec_params_lightbar *)msg->data;
         param->cmd = LIGHTBAR_CMD_BRIGHTNESS;
         param->brightness.num = val;
         ret = lb_throttle();
         if (ret)
-                return ret;
+                goto exit;
 
-        ret = cros_ec_cmd_xfer(ec, &msg);
+        ret = cros_ec_cmd_xfer(ec, msg);
         if (ret < 0)
-                return ret;
+                goto exit;
 
-        if (msg.result != EC_RES_SUCCESS)
-                return -EINVAL;
+        if (msg->result != EC_RES_SUCCESS) {
+                ret = -EINVAL;
+                goto exit;
+        }
 
-        return count;
+        ret = count;
+exit:
+        kfree(msg);
+        return ret;
 }
 
 
@@ -196,12 +230,15 @@ static ssize_t led_rgb_store(struct device *dev, struct device_attribute *attr,
                              const char *buf, size_t count)
 {
         struct ec_params_lightbar *param;
-        struct ec_response_lightbar *resp;
-        struct cros_ec_command msg = INIT_MSG(param, resp);
+        struct cros_ec_command *msg;
         struct cros_ec_device *ec = dev_get_drvdata(dev);
         unsigned int val[4];
         int ret, i = 0, j = 0, ok = 0;
 
+        msg = alloc_lightbar_cmd_msg();
+        if (!msg)
+                return -ENOMEM;
+
         do {
                 /* Skip any whitespace */
                 while (*buf && isspace(*buf))
@@ -215,7 +252,7 @@ static ssize_t led_rgb_store(struct device *dev, struct device_attribute *attr,
                         return -EINVAL;
 
                 if (i == 4) {
-                        param = (struct ec_params_lightbar *)msg.outdata;
+                        param = (struct ec_params_lightbar *)msg->data;
                         param->cmd = LIGHTBAR_CMD_RGB;
                         param->rgb.led = val[0];
                         param->rgb.red = val[1];
@@ -231,12 +268,14 @@ static ssize_t led_rgb_store(struct device *dev, struct device_attribute *attr,
                                         return ret;
                         }
 
-                        ret = cros_ec_cmd_xfer(ec, &msg);
+                        ret = cros_ec_cmd_xfer(ec, msg);
                         if (ret < 0)
-                                return ret;
+                                goto exit;
 
-                        if (msg.result != EC_RES_SUCCESS)
-                                return -EINVAL;
+                        if (msg->result != EC_RES_SUCCESS) {
+                                ret = -EINVAL;
+                                goto exit;
+                        }
 
                         i = 0;
                         ok = 1;
@@ -248,6 +287,8 @@ static ssize_t led_rgb_store(struct device *dev, struct device_attribute *attr,
 
         } while (*buf);
 
+exit:
+        kfree(msg);
         return (ok && i == 0) ? count : -EINVAL;
 }
 
@@ -261,42 +302,55 @@ static ssize_t sequence_show(struct device *dev,
 {
         struct ec_params_lightbar *param;
         struct ec_response_lightbar *resp;
-        struct cros_ec_command msg = INIT_MSG(param, resp);
+        struct cros_ec_command *msg;
         int ret;
         struct cros_ec_device *ec = dev_get_drvdata(dev);
 
-        param = (struct ec_params_lightbar *)msg.outdata;
+        msg = alloc_lightbar_cmd_msg();
+        if (!msg)
+                return -ENOMEM;
+
+        param = (struct ec_params_lightbar *)msg->data;
         param->cmd = LIGHTBAR_CMD_GET_SEQ;
         ret = lb_throttle();
         if (ret)
-                return ret;
+                goto exit;
 
-        ret = cros_ec_cmd_xfer(ec, &msg);
+        ret = cros_ec_cmd_xfer(ec, msg);
         if (ret < 0)
-                return ret;
+                goto exit;
 
-        if (msg.result != EC_RES_SUCCESS)
-                return scnprintf(buf, PAGE_SIZE,
-                                 "ERROR: EC returned %d\n", msg.result);
+        if (msg->result != EC_RES_SUCCESS) {
+                ret = scnprintf(buf, PAGE_SIZE,
+                                "ERROR: EC returned %d\n", msg->result);
+                goto exit;
+        }
 
-        resp = (struct ec_response_lightbar *)msg.indata;
+        resp = (struct ec_response_lightbar *)msg->data;
         if (resp->get_seq.num >= ARRAY_SIZE(seqname))
-                return scnprintf(buf, PAGE_SIZE, "%d\n", resp->get_seq.num);
+                ret = scnprintf(buf, PAGE_SIZE, "%d\n", resp->get_seq.num);
         else
-                return scnprintf(buf, PAGE_SIZE, "%s\n",
-                                 seqname[resp->get_seq.num]);
+                ret = scnprintf(buf, PAGE_SIZE, "%s\n",
+                                seqname[resp->get_seq.num]);
+
+exit:
+        kfree(msg);
+        return ret;
 }
 
 static ssize_t sequence_store(struct device *dev, struct device_attribute *attr,
                               const char *buf, size_t count)
 {
         struct ec_params_lightbar *param;
-        struct ec_response_lightbar *resp;
-        struct cros_ec_command msg = INIT_MSG(param, resp);
+        struct cros_ec_command *msg;
         unsigned int num;
         int ret, len;
         struct cros_ec_device *ec = dev_get_drvdata(dev);
 
+        msg = alloc_lightbar_cmd_msg();
+        if (!msg)
+                return -ENOMEM;
+
         for (len = 0; len < count; len++)
                 if (!isalnum(buf[len]))
                         break;
@@ -311,18 +365,18 @@ static ssize_t sequence_store(struct device *dev, struct device_attribute *attr,
                         return ret;
         }
 
-        param = (struct ec_params_lightbar *)msg.outdata;
+        param = (struct ec_params_lightbar *)msg->data;
         param->cmd = LIGHTBAR_CMD_SEQ;
         param->seq.num = num;
         ret = lb_throttle();
         if (ret)
                 return ret;
 
-        ret = cros_ec_cmd_xfer(ec, &msg);
+        ret = cros_ec_cmd_xfer(ec, msg);
         if (ret < 0)
                 return ret;
 
-        if (msg.result != EC_RES_SUCCESS)
+        if (msg->result != EC_RES_SUCCESS)
                 return -EINVAL;
 
         return count;
diff --git a/drivers/platform/chrome/cros_ec_lpc.c b/drivers/platform/chrome/cros_ec_lpc.c
index 860310513cf0..4c7f0df33bf8 100644
--- a/drivers/platform/chrome/cros_ec_lpc.c
+++ b/drivers/platform/chrome/cros_ec_lpc.c
@@ -73,8 +73,8 @@ static int cros_ec_cmd_xfer_lpc(struct cros_ec_device *ec,
 
         /* Copy data and update checksum */
         for (i = 0; i < msg->outsize; i++) {
-                outb(msg->outdata[i], EC_LPC_ADDR_HOST_PARAM + i);
-                csum += msg->outdata[i];
+                outb(msg->data[i], EC_LPC_ADDR_HOST_PARAM + i);
+                csum += msg->data[i];
         }
 
         /* Finalize checksum and write args */
@@ -129,8 +129,8 @@ static int cros_ec_cmd_xfer_lpc(struct cros_ec_device *ec,
 
         /* Read response and update checksum */
         for (i = 0; i < args.data_size; i++) {
-                msg->indata[i] = inb(EC_LPC_ADDR_HOST_PARAM + i);
-                csum += msg->indata[i];
+                msg->data[i] = inb(EC_LPC_ADDR_HOST_PARAM + i);
+                csum += msg->data[i];
         }
 
         /* Verify checksum */
diff --git a/drivers/platform/chrome/cros_ec_sysfs.c b/drivers/platform/chrome/cros_ec_sysfs.c
index fb62ab6cc659..78ba82d670cb 100644
--- a/drivers/platform/chrome/cros_ec_sysfs.c
+++ b/drivers/platform/chrome/cros_ec_sysfs.c
@@ -29,6 +29,7 @@
 #include <linux/module.h>
 #include <linux/platform_device.h>
 #include <linux/printk.h>
+#include <linux/slab.h>
 #include <linux/stat.h>
 #include <linux/types.h>
 #include <linux/uaccess.h>
@@ -66,14 +67,19 @@ static ssize_t store_ec_reboot(struct device *dev,
                 {"hibernate",    EC_REBOOT_HIBERNATE, 0},
                 {"at-shutdown",  -1, EC_REBOOT_FLAG_ON_AP_SHUTDOWN},
         };
-        struct cros_ec_command msg = { 0 };
-        struct ec_params_reboot_ec *param =
-                (struct ec_params_reboot_ec *)msg.outdata;
+        struct cros_ec_command *msg;
+        struct ec_params_reboot_ec *param;
         int got_cmd = 0, offset = 0;
         int i;
         int ret;
         struct cros_ec_device *ec = dev_get_drvdata(dev);
 
+        msg = kmalloc(sizeof(*msg) + sizeof(*param), GFP_KERNEL);
+        if (!msg)
+                return -ENOMEM;
+
+        param = (struct ec_params_reboot_ec *)msg->data;
+
         param->flags = 0;
         while (1) {
                 /* Find word to start scanning */
@@ -100,19 +106,26 @@ static ssize_t store_ec_reboot(struct device *dev,
                         offset++;
         }
 
-        if (!got_cmd)
-                return -EINVAL;
-
-        msg.command = EC_CMD_REBOOT_EC;
-        msg.outsize = sizeof(param);
-        ret = cros_ec_cmd_xfer(ec, &msg);
-        if (ret < 0)
-                return ret;
-        if (msg.result != EC_RES_SUCCESS) {
-                dev_dbg(ec->dev, "EC result %d\n", msg.result);
-                return -EINVAL;
+        if (!got_cmd) {
+                count = -EINVAL;
+                goto exit;
         }
 
+        msg->version = 0;
+        msg->command = EC_CMD_REBOOT_EC;
+        msg->outsize = sizeof(*param);
+        msg->insize = 0;
+        ret = cros_ec_cmd_xfer(ec, msg);
+        if (ret < 0) {
+                count = ret;
+                goto exit;
+        }
+        if (msg->result != EC_RES_SUCCESS) {
+                dev_dbg(ec->dev, "EC result %d\n", msg->result);
+                count = -EINVAL;
+        }
+exit:
+        kfree(msg);
         return count;
 }
 
@@ -123,22 +136,32 @@ static ssize_t show_ec_version(struct device *dev,
         struct ec_response_get_version *r_ver;
         struct ec_response_get_chip_info *r_chip;
         struct ec_response_board_version *r_board;
-        struct cros_ec_command msg = { 0 };
+        struct cros_ec_command *msg;
         int ret;
         int count = 0;
         struct cros_ec_device *ec = dev_get_drvdata(dev);
 
+        msg = kmalloc(sizeof(*msg) + EC_HOST_PARAM_SIZE, GFP_KERNEL);
+        if (!msg)
+                return -ENOMEM;
+
         /* Get versions. RW may change. */
-        msg.command = EC_CMD_GET_VERSION;
-        msg.insize = sizeof(*r_ver);
-        ret = cros_ec_cmd_xfer(ec, &msg);
-        if (ret < 0)
-                return ret;
-        if (msg.result != EC_RES_SUCCESS)
-                return scnprintf(buf, PAGE_SIZE,
-                                 "ERROR: EC returned %d\n", msg.result);
+        msg->version = 0;
+        msg->command = EC_CMD_GET_VERSION;
+        msg->insize = sizeof(*r_ver);
+        msg->outsize = 0;
+        ret = cros_ec_cmd_xfer(ec, msg);
+        if (ret < 0) {
+                count = ret;
+                goto exit;
+        }
+        if (msg->result != EC_RES_SUCCESS) {
+                count = scnprintf(buf, PAGE_SIZE,
+                                  "ERROR: EC returned %d\n", msg->result);
+                goto exit;
+        }
 
-        r_ver = (struct ec_response_get_version *)msg.indata;
+        r_ver = (struct ec_response_get_version *)msg->data;
         /* Strings should be null-terminated, but let's be sure. */
         r_ver->version_string_ro[sizeof(r_ver->version_string_ro) - 1] = '\0';
         r_ver->version_string_rw[sizeof(r_ver->version_string_rw) - 1] = '\0';
@@ -152,33 +175,33 @@ static ssize_t show_ec_version(struct device *dev,
                             image_names[r_ver->current_image] : "?"));
 
         /* Get build info. */
-        msg.command = EC_CMD_GET_BUILD_INFO;
-        msg.insize = sizeof(msg.indata);
-        ret = cros_ec_cmd_xfer(ec, &msg);
+        msg->command = EC_CMD_GET_BUILD_INFO;
+        msg->insize = EC_HOST_PARAM_SIZE;
+        ret = cros_ec_cmd_xfer(ec, msg);
         if (ret < 0)
                 count += scnprintf(buf + count, PAGE_SIZE - count,
                                    "Build info:    XFER ERROR %d\n", ret);
-        else if (msg.result != EC_RES_SUCCESS)
+        else if (msg->result != EC_RES_SUCCESS)
                 count += scnprintf(buf + count, PAGE_SIZE - count,
-                                   "Build info:    EC error %d\n", msg.result);
+                                   "Build info:    EC error %d\n", msg->result);
         else {
-                msg.indata[sizeof(msg.indata) - 1] = '\0';
+                msg->data[sizeof(msg->data) - 1] = '\0';
                 count += scnprintf(buf + count, PAGE_SIZE - count,
-                                   "Build info:    %s\n", msg.indata);
+                                   "Build info:    %s\n", msg->data);
         }
 
         /* Get chip info. */
-        msg.command = EC_CMD_GET_CHIP_INFO;
-        msg.insize = sizeof(*r_chip);
-        ret = cros_ec_cmd_xfer(ec, &msg);
+        msg->command = EC_CMD_GET_CHIP_INFO;
+        msg->insize = sizeof(*r_chip);
+        ret = cros_ec_cmd_xfer(ec, msg);
         if (ret < 0)
                 count += scnprintf(buf + count, PAGE_SIZE - count,
                                    "Chip info:     XFER ERROR %d\n", ret);
-        else if (msg.result != EC_RES_SUCCESS)
+        else if (msg->result != EC_RES_SUCCESS)
                 count += scnprintf(buf + count, PAGE_SIZE - count,
-                                   "Chip info:     EC error %d\n", msg.result);
+                                   "Chip info:     EC error %d\n", msg->result);
         else {
-                r_chip = (struct ec_response_get_chip_info *)msg.indata;
+                r_chip = (struct ec_response_get_chip_info *)msg->data;
 
                 r_chip->vendor[sizeof(r_chip->vendor) - 1] = '\0';
                 r_chip->name[sizeof(r_chip->name) - 1] = '\0';
@@ -192,23 +215,25 @@ static ssize_t show_ec_version(struct device *dev,
         }
 
         /* Get board version */
-        msg.command = EC_CMD_GET_BOARD_VERSION;
-        msg.insize = sizeof(*r_board);
-        ret = cros_ec_cmd_xfer(ec, &msg);
+        msg->command = EC_CMD_GET_BOARD_VERSION;
+        msg->insize = sizeof(*r_board);
+        ret = cros_ec_cmd_xfer(ec, msg);
         if (ret < 0)
                 count += scnprintf(buf + count, PAGE_SIZE - count,
                                    "Board version: XFER ERROR %d\n", ret);
-        else if (msg.result != EC_RES_SUCCESS)
+        else if (msg->result != EC_RES_SUCCESS)
                 count += scnprintf(buf + count, PAGE_SIZE - count,
-                                   "Board version: EC error %d\n", msg.result);
+                                   "Board version: EC error %d\n", msg->result);
         else {
-                r_board = (struct ec_response_board_version *)msg.indata;
+                r_board = (struct ec_response_board_version *)msg->data;
 
                 count += scnprintf(buf + count, PAGE_SIZE - count,
                                    "Board version: %d\n",
                                    r_board->board_version);
         }
 
+exit:
+        kfree(msg);
         return count;
 }
 
@@ -216,27 +241,38 @@ static ssize_t show_ec_flashinfo(struct device *dev,
                                  struct device_attribute *attr, char *buf)
 {
         struct ec_response_flash_info *resp;
-        struct cros_ec_command msg = { 0 };
+        struct cros_ec_command *msg;
         int ret;
         struct cros_ec_device *ec = dev_get_drvdata(dev);
 
+        msg = kmalloc(sizeof(*msg) + sizeof(*resp), GFP_KERNEL);
+        if (!msg)
+                return -ENOMEM;
+
         /* The flash info shouldn't ever change, but ask each time anyway. */
-        msg.command = EC_CMD_FLASH_INFO;
-        msg.insize = sizeof(*resp);
-        ret = cros_ec_cmd_xfer(ec, &msg);
+        msg->version = 0;
+        msg->command = EC_CMD_FLASH_INFO;
+        msg->insize = sizeof(*resp);
+        msg->outsize = 0;
+        ret = cros_ec_cmd_xfer(ec, msg);
         if (ret < 0)
-                return ret;
-        if (msg.result != EC_RES_SUCCESS)
-                return scnprintf(buf, PAGE_SIZE,
-                                 "ERROR: EC returned %d\n", msg.result);
-
-        resp = (struct ec_response_flash_info *)msg.indata;
-
-        return scnprintf(buf, PAGE_SIZE,
-                         "FlashSize %d\nWriteSize %d\n"
-                         "EraseSize %d\nProtectSize %d\n",
-                         resp->flash_size, resp->write_block_size,
-                         resp->erase_block_size, resp->protect_block_size);
+                goto exit;
+        if (msg->result != EC_RES_SUCCESS) {
+                ret = scnprintf(buf, PAGE_SIZE,
+                                "ERROR: EC returned %d\n", msg->result);
+                goto exit;
+        }
+
+        resp = (struct ec_response_flash_info *)msg->data;
+
+        ret = scnprintf(buf, PAGE_SIZE,
+                        "FlashSize %d\nWriteSize %d\n"
+                        "EraseSize %d\nProtectSize %d\n",
+                        resp->flash_size, resp->write_block_size,
+                        resp->erase_block_size, resp->protect_block_size);
+exit:
+        kfree(msg);
+        return ret;
 }
 
 /* Module initialization */