Commit 4ca6c58e authored by Aleksa Savic's avatar Aleksa Savic Committed by sanglipeng1
Browse files

hwmon: (corsair-cpro) Use a separate buffer for sending commands 

stable inclusion
from stable-v5.10.217
commit 549e740badb97b6c9cfa4d70d02be534ba7c6816
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/IAWLXC

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=549e740badb97b6c9cfa4d70d02be534ba7c6816



--------------------------------

[ Upstream commit e0cd85dc666cb08e1bd313d560cb4eff4d04219e ]

Introduce cmd_buffer, a separate buffer for storing only
the command that is sent to the device. Before this separation,
the existing buffer was shared for both the command and the
report received in ccp_raw_event(), which was copied into it.

However, because of hidraw, the raw event parsing may be triggered
in the middle of sending a command, resulting in outputting gibberish
to the device. Using a separate buffer resolves this.

Fixes: 40c3a445 ("hwmon: add Corsair Commander Pro driver")
Signed-off-by: default avatarAleksa Savic <savicaleksa83@gmail.com>
Acked-by: default avatarMarius Zachmann <mail@mariuszachmann.de>
Link: https://lore.kernel.org/r/20240504092504.24158-2-savicaleksa83@gmail.com


Signed-off-by: default avatarGuenter Roeck <linux@roeck-us.net>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
Signed-off-by: default avatarsanglipeng1 <sanglipeng1@jd.com>
parent 9d009cb9

drivers/hwmon/corsair-cpro.c

+12 −7
Original line number Diff line number Diff line
@@ -79,6 +79,7 @@ struct ccp_device { 
	struct device *hwmon_dev;

	struct completion wait_input_report;

	struct mutex mutex; /* whenever buffer is used, lock before send_usb_cmd */

	u8 *cmd_buffer;

	u8 *buffer;

	int target[6];

	DECLARE_BITMAP(temp_cnct, NUM_TEMP_SENSORS);
@@ -111,15 +112,15 @@ static int send_usb_cmd(struct ccp_device *ccp, u8 command, u8 byte1, u8 byte2, 
	unsigned long t;

	int ret;



	memset(ccp->buffer, 0x00, OUT_BUFFER_SIZE);

	ccp->buffer[0] = command;

	ccp->buffer[1] = byte1;

	ccp->buffer[2] = byte2;

	ccp->buffer[3] = byte3;

	memset(ccp->cmd_buffer, 0x00, OUT_BUFFER_SIZE);

	ccp->cmd_buffer[0] = command;

	ccp->cmd_buffer[1] = byte1;

	ccp->cmd_buffer[2] = byte2;

	ccp->cmd_buffer[3] = byte3;



	reinit_completion(&ccp->wait_input_report);



	ret = hid_hw_output_report(ccp->hdev, ccp->buffer, OUT_BUFFER_SIZE);

	ret = hid_hw_output_report(ccp->hdev, ccp->cmd_buffer, OUT_BUFFER_SIZE);

	if (ret < 0)

		return ret;
@@ -491,7 +492,11 @@ static int ccp_probe(struct hid_device *hdev, const struct hid_device_id *id) 
	if (!ccp)

		return -ENOMEM;



	ccp->buffer = devm_kmalloc(&hdev->dev, OUT_BUFFER_SIZE, GFP_KERNEL);

	ccp->cmd_buffer = devm_kmalloc(&hdev->dev, OUT_BUFFER_SIZE, GFP_KERNEL);

	if (!ccp->cmd_buffer)

		return -ENOMEM;



	ccp->buffer = devm_kmalloc(&hdev->dev, IN_BUFFER_SIZE, GFP_KERNEL);

	if (!ccp->buffer)

		return -ENOMEM;