static int alloc_gbuf_data(struct gbuf *gbuf, unsigned int size,
gfp_t gfp_mask)
{
- u8 dest_cport_id = gbuf->dest_cport_id;
u8 *buffer;
if (gbuf->transfer_buffer)
return -ENOMEM;
buffer += GB_BUFFER_ALIGN;
- /* Insert the cport id for outbound buffers */
- if (dest_cport_id != CPORT_ID_BAD && dest_cport_id > (u16)U8_MAX) {
- pr_err("dest_cport_id (%hd) is out of range!\n",
- gbuf->dest_cport_id);
- kfree(buffer);
- return -EINVAL;
- }
- *(buffer - 1) = gbuf->dest_cport_id;
-
gbuf->transfer_buffer = buffer;
gbuf->transfer_buffer_length = size;
struct greybus_host_device *hd = gbuf->hd;
struct es1_ap_dev *es1 = hd_to_es1(hd);
struct usb_device *udev = es1->usb_dev;
+ u16 dest_cport_id = gbuf->dest_cport_id;
int retval;
u8 *transfer_buffer;
u8 *buffer;
return -EINVAL;
buffer = &transfer_buffer[-1]; /* yes, we mean -1 */
- /* Do one last check of the target CPort id */
- if (*buffer == CPORT_ID_BAD) {
- pr_err("request to submit inbound buffer\n");
+ /* Do one last check of the target CPort id before filling it in */
+ if (dest_cport_id == CPORT_ID_BAD) {
+ pr_err("request to send inbound data buffer\n");
+ return -EINVAL;
+ }
+ if (dest_cport_id > (u16)U8_MAX) {
+ pr_err("dest_cport_id (%hd) is out of range for ES1\n",
+ dest_cport_id);
return -EINVAL;
}
+ *buffer = dest_cport_id;
/* Find a free urb */
urb = next_free_urb(es1, gfp_mask);
else
dest_cport_id = CPORT_ID_BAD;
- gbuf->hd = hd;
- gbuf->dest_cport_id = dest_cport_id;
- gbuf->status = -EBADR; /* Initial value--means "never set" */
ret = hd->driver->alloc_gbuf_data(gbuf, size, gfp_flags);
if (ret)
return ret;
+ gbuf->hd = hd;
+ gbuf->dest_cport_id = dest_cport_id;
+ gbuf->status = -EBADR; /* Initial value--means "never set" */
/* Fill in the header structure */
header = (struct gb_operation_msg_hdr *)gbuf->transfer_buffer;