[RFC PATCH] i2c: robotfuzz-osif: use DMA-safe buffers for message data

[Wang Xiong]

The SMBus emulation layer can pass stack-backed I2C message buffers to
the adapter. osif_xfer() forwards those buffers to usb_control_msg(),
which requires DMA-safe storage for nonzero data transfers. An archived
SMBus read report reaches the USB core's stack-buffer check and the
transfer is rejected.

Obtain a DMA-safe buffer for each nonempty message and release it after
the synchronous control transfer. Copy received data back only when the
full message completed. Keep the existing short-transfer error handling
and allow zero-length writes without treating them as allocation failures.

Assisted-by: LLM
Signed-off-by: Wang Xiong <20221010117@xxxxxxxxxxxxxxx>
---
 drivers/i2c/busses/i2c-robotfuzz-osif.c | 25 +++++++++++++++----------
 1 file changed, 15 insertions(+), 10 deletions(-)

diff --git a/drivers/i2c/busses/i2c-robotfuzz-osif.c b/drivers/i2c/busses/i2c-robotfuzz-osif.c
index 412fa8e37..786c3f1b4 100644
--- a/drivers/i2c/busses/i2c-robotfuzz-osif.c
+++ b/drivers/i2c/busses/i2c-robotfuzz-osif.c
@@ -59,28 +59,33 @@ static int osif_xfer(struct i2c_adapter *adapter, struct i2c_msg *msgs,
 {
 	struct osif_priv *priv = adapter->algo_data;
 	struct i2c_msg *pmsg;
+	u8 *buf;
 	int ret;
 	int i;
 
 	for (i = 0; i < num; i++) {
 		pmsg = &msgs[i];
+		buf = pmsg->buf;
+		if (pmsg->len) {
+			buf = i2c_get_dma_safe_msg_buf(pmsg, 1);
+			if (!buf)
+				return -ENOMEM;
+		}
 
 		if (pmsg->flags & I2C_M_RD) {
 			ret = osif_usb_read(adapter, OSIFI2C_READ,
 					    pmsg->flags, pmsg->addr,
-					    pmsg->buf, pmsg->len);
-			if (ret != pmsg->len) {
-				dev_err(&adapter->dev, "failure reading data\n");
-				return -EREMOTEIO;
-			}
+					    buf, pmsg->len);
 		} else {
 			ret = osif_usb_write(adapter, OSIFI2C_WRITE,
 					     pmsg->flags, pmsg->addr,
-					     pmsg->buf, pmsg->len);
-			if (ret != pmsg->len) {
-				dev_err(&adapter->dev, "failure writing data\n");
-				return -EREMOTEIO;
-			}
+					     buf, pmsg->len);
+		}
+		i2c_put_dma_safe_msg_buf(buf, pmsg, ret == pmsg->len);
+		if (ret != pmsg->len) {
+			dev_err(&adapter->dev, "failure %s data\n",
+				pmsg->flags & I2C_M_RD ? "reading" : "writing");
+			return -EREMOTEIO;
 		}
 
 		ret = osif_usb_write(adapter, OSIFI2C_STOP, 0, 0, NULL, 0);
-- 
2.47.3