From ea007cb6697b651b5298a37a15a6ccf5b63d3680 Mon Sep 17 00:00:00 2001
From: Josh Boyer <jwboyer@redhat.com>
Date: Jun 27 2013 13:36:54 +0000
Subject: Fix stack memory usage for DMA in ath3k (rhbz 977558)


---

diff --git a/ath3k-dont-use-stack-memory-for-DMA.patch b/ath3k-dont-use-stack-memory-for-DMA.patch
new file mode 100644
index 0000000..610a000
--- /dev/null
+++ b/ath3k-dont-use-stack-memory-for-DMA.patch
@@ -0,0 +1,72 @@
+Memory allocated by vmalloc (including stack) can not be used for DMA,
+i.e. data pointer on usb_control_msg() should not point to stack memory.
+
+Resolves:
+https://bugzilla.redhat.com/show_bug.cgi?id=977558
+
+Reported-and-tested-by: Andy Lawrence <dr.diesel@gmail.com>
+Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
+---
+ drivers/bluetooth/ath3k.c | 38 +++++++++++++++++++++++++++++---------
+ 1 file changed, 29 insertions(+), 9 deletions(-)
+
+diff --git a/drivers/bluetooth/ath3k.c b/drivers/bluetooth/ath3k.c
+index 11f467c..81b636c 100644
+--- a/drivers/bluetooth/ath3k.c
++++ b/drivers/bluetooth/ath3k.c
+@@ -193,24 +193,44 @@ error:
+ 
+ static int ath3k_get_state(struct usb_device *udev, unsigned char *state)
+ {
+-	int pipe = 0;
++	int ret, pipe = 0;
++	char *buf;
++
++	buf = kmalloc(1, GFP_KERNEL);
++	if (!buf)
++		return -ENOMEM;
+ 
+ 	pipe = usb_rcvctrlpipe(udev, 0);
+-	return usb_control_msg(udev, pipe, ATH3K_GETSTATE,
+-			USB_TYPE_VENDOR | USB_DIR_IN, 0, 0,
+-			state, 0x01, USB_CTRL_SET_TIMEOUT);
++	ret = usb_control_msg(udev, pipe, ATH3K_GETSTATE,
++			      USB_TYPE_VENDOR | USB_DIR_IN, 0, 0,
++			      buf, 1, USB_CTRL_SET_TIMEOUT);
++
++	*state = *buf;
++	kfree(buf);
++
++	return ret;
+ }
+ 
+ static int ath3k_get_version(struct usb_device *udev,
+ 			struct ath3k_version *version)
+ {
+-	int pipe = 0;
++	int ret, pipe = 0;
++	char *buf;
++	const int size = sizeof(struct ath3k_version);
++	
++	buf = kmalloc(size, GFP_KERNEL);
++	if (!buf)
++		return -ENOMEM;
+ 
+ 	pipe = usb_rcvctrlpipe(udev, 0);
+-	return usb_control_msg(udev, pipe, ATH3K_GETVERSION,
+-			USB_TYPE_VENDOR | USB_DIR_IN, 0, 0, version,
+-			sizeof(struct ath3k_version),
+-			USB_CTRL_SET_TIMEOUT);
++	ret = usb_control_msg(udev, pipe, ATH3K_GETVERSION,
++			      USB_TYPE_VENDOR | USB_DIR_IN, 0, 0,
++			      buf, size, USB_CTRL_SET_TIMEOUT);
++
++	memcpy(version, buf, size);
++	kfree(buf);
++
++	return ret;
+ }
+ 
+ static int ath3k_load_fwfile(struct usb_device *udev,
+-- 
+1.7.11.7
diff --git a/kernel.spec b/kernel.spec
index c895a74..dae355c 100644
--- a/kernel.spec
+++ b/kernel.spec
@@ -808,6 +808,9 @@ Patch25052: HID-input-return-ENODATA-if-reading-battery-attrs-fails.patch
 Patch25053: bridge-only-expire-the-mdb-entry-when-query-is-received.patch
 Patch25054: bridge-send-query-as-soon-as-leave-is-received.patch
 
+#rhbz 977558
+Patch25055: ath3k-dont-use-stack-memory-for-DMA.patch
+
 # END OF PATCH DEFINITIONS
 
 %endif
@@ -1565,6 +1568,9 @@ ApplyPatch HID-input-return-ENODATA-if-reading-battery-attrs-fails.patch
 ApplyPatch bridge-only-expire-the-mdb-entry-when-query-is-received.patch
 ApplyPatch bridge-send-query-as-soon-as-leave-is-received.patch
 
+#rhbz 977558
+ApplyPatch ath3k-dont-use-stack-memory-for-DMA.patch
+
 # END OF PATCH APPLICATIONS
 
 %endif
@@ -2381,6 +2387,9 @@ fi
 # and build.
 
 %changelog
+* Thu Jun 27 2013 Josh Boyer <jwboyer@redhat.com>
+- Fix stack memory usage for DMA in ath3k (rhbz 977558)
+
 * Wed Jun 26 2013 Josh Boyer <jwboyer@redhat.com>
 - Add two patches to fix bridge networking issues (rhbz 880035)