Re: [PATCH 7.0.y 2/2] media: rc: ttusbir: respect DMA coherency rules

[sean@mess.org]

Hello,

This commit is broken - please do not merge.

On Fri, May 01, 2026 at 09:19:03AM -0400, Sasha Levin wrote:
> From: Oliver Neukum <oneukum@suse.com>
> 
> [ Upstream commit 50acaad3d202c064779db8dc3d010007347f59c7 ]
> 
> Buffers must not share a cache line with other data structures.
> Allocate separately.
> 
> Fixes: 0938069fa0897 ("[media] rc: Add support for the TechnoTrend USB IR Receiver")
> Cc: stable@vger.kernel.org
> Signed-off-by: Oliver Neukum <oneukum@suse.com>
> Signed-off-by: Sean Young <sean@mess.org>
> Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
> Signed-off-by: Sasha Levin <sashal@kernel.org>
> ---
>  drivers/media/rc/ttusbir.c | 13 +++++++++----
>  1 file changed, 9 insertions(+), 4 deletions(-)
> 
> diff --git a/drivers/media/rc/ttusbir.c b/drivers/media/rc/ttusbir.c
> index a2a64a860264b..3848ad3a6b85f 100644
> --- a/drivers/media/rc/ttusbir.c
> +++ b/drivers/media/rc/ttusbir.c
> @@ -32,7 +32,7 @@ struct ttusbir {
>  
>  	struct led_classdev led;
>  	struct urb *bulk_urb;
> -	uint8_t bulk_buffer[5];
> +	u8 *bulk_buffer;
>  	int bulk_out_endp, iso_in_endp;
>  	bool led_on, is_led_on;
>  	atomic_t led_complete;
> @@ -186,13 +186,16 @@ static int ttusbir_probe(struct usb_interface *intf,
>  	struct rc_dev *rc;
>  	int i, j, ret;
>  	int altsetting = -1;
> +	u8 *buffer;
>  
>  	tt = kzalloc_obj(*tt);
> +	buffer = kzalloc(5, GFP_KERNEL);
>  	rc = rc_allocate_device(RC_DRIVER_IR_RAW);
> -	if (!tt || !rc) {
> +	if (!tt || !rc || buffer) {

Here buffer will be non-zero and the probe function will fail.

A fix is on the way to master but it's not there yet.

THanks,
Sean
>  		ret = -ENOMEM;
>  		goto out;
>  	}
> +	tt->bulk_buffer = buffer;
>  
>  	/* find the correct alt setting */
>  	for (i = 0; i < intf->num_altsetting && altsetting == -1; i++) {
> @@ -281,8 +284,8 @@ static int ttusbir_probe(struct usb_interface *intf,
>  	tt->bulk_buffer[3] = 0x01;
>  
>  	usb_fill_bulk_urb(tt->bulk_urb, tt->udev, usb_sndbulkpipe(tt->udev,
> -		tt->bulk_out_endp), tt->bulk_buffer, sizeof(tt->bulk_buffer),
> -						ttusbir_bulk_complete, tt);
> +			  tt->bulk_out_endp), tt->bulk_buffer, 5,
> +			  ttusbir_bulk_complete, tt);
>  
>  	tt->led.name = "ttusbir:green:power";
>  	tt->led.default_trigger = "rc-feedback";
> @@ -350,6 +353,7 @@ static int ttusbir_probe(struct usb_interface *intf,
>  		kfree(tt);
>  	}
>  	rc_free_device(rc);
> +	kfree(buffer);
>  
>  	return ret;
>  }
> @@ -373,6 +377,7 @@ static void ttusbir_disconnect(struct usb_interface *intf)
>  	usb_kill_urb(tt->bulk_urb);
>  	usb_free_urb(tt->bulk_urb);
>  	rc_free_device(tt->rc);
> +	kfree(tt->bulk_buffer);
>  	usb_set_intfdata(intf, NULL);
>  	kfree(tt);
>  }
> -- 
> 2.53.0