Bluetooth: btrtl: Use kvmalloc for FW allocations

Currently, kmemdup is applied to the firmware data, and it invokes
kmalloc under the hood. The firmware size and patch_length are big (more
than PAGE_SIZE), and on some low-end systems (like ASUS E202SA) kmalloc
may fail to allocate a contiguous chunk under high memory usage and
fragmentation:

Bluetooth: hci0: RTL: examining hci_ver=06 hci_rev=000a lmp_ver=06 lmp_subver=8821
Bluetooth: hci0: RTL: rom_version status=0 version=1
Bluetooth: hci0: RTL: loading rtl_bt/rtl8821a_fw.bin
kworker/u9:2: page allocation failure: order:4, mode:0x40cc0(GFP_KERNEL|__GFP_COMP), nodemask=(null),cpuset=/,mems_allowed=0
<stack trace follows>

As firmware load happens on each resume, Bluetooth will stop working
after several iterations, when the kernel fails to allocate an order-4
page.

This patch replaces kmemdup with kvmalloc+memcpy. It's not required to
have a contiguous chunk here, because it's not mapped to the device
directly.

Signed-off-by: Maxim Mikityanskiy <maxtram95@gmail.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>

diff --git a/drivers/bluetooth/btrtl.c b/drivers/bluetooth/btrtl.c
index f838537f9f89f307c77318b268b58dfe0d4ed543..577cfa3329dbc6f07a9d9e01be06665cea7284a5 100644 (file)
--- a/drivers/bluetooth/btrtl.c
+++ b/drivers/bluetooth/btrtl.c
@@ -370,11 +370,11 @@ static int rtlbt_parse_firmware(struct hci_dev *hdev,
         * the end.
         */
        len = patch_length;
-       buf = kmemdup(btrtl_dev->fw_data + patch_offset, patch_length,
-                     GFP_KERNEL);
+       buf = kvmalloc(patch_length, GFP_KERNEL);
        if (!buf)
                return -ENOMEM;
 
+       memcpy(buf, btrtl_dev->fw_data + patch_offset, patch_length - 4);
        memcpy(buf + patch_length - 4, &epatch_info->fw_version, 4);
 
        *_buf = buf;
@@ -460,8 +460,10 @@ static int rtl_load_file(struct hci_dev *hdev, const char *name, u8 **buff)
        if (ret < 0)
                return ret;
        ret = fw->size;
-       *buff = kmemdup(fw->data, ret, GFP_KERNEL);
-       if (!*buff)
+       *buff = kvmalloc(fw->size, GFP_KERNEL);
+       if (*buff)
+               memcpy(*buff, fw->data, ret);
+       else
                ret = -ENOMEM;
 
        release_firmware(fw);
@@ -499,14 +501,14 @@ static int btrtl_setup_rtl8723b(struct hci_dev *hdev,
                goto out;
 
        if (btrtl_dev->cfg_len > 0) {
-               tbuff = kzalloc(ret + btrtl_dev->cfg_len, GFP_KERNEL);
+               tbuff = kvzalloc(ret + btrtl_dev->cfg_len, GFP_KERNEL);
                if (!tbuff) {
                        ret = -ENOMEM;
                        goto out;
                }
 
                memcpy(tbuff, fw_data, ret);
-               kfree(fw_data);
+               kvfree(fw_data);
 
                memcpy(tbuff + ret, btrtl_dev->cfg_data, btrtl_dev->cfg_len);
                ret += btrtl_dev->cfg_len;
@@ -519,14 +521,14 @@ static int btrtl_setup_rtl8723b(struct hci_dev *hdev,
        ret = rtl_download_firmware(hdev, fw_data, ret);
 
 out:
-       kfree(fw_data);
+       kvfree(fw_data);
        return ret;
 }
 
 void btrtl_free(struct btrtl_device_info *btrtl_dev)
 {
-       kfree(btrtl_dev->fw_data);
-       kfree(btrtl_dev->cfg_data);
+       kvfree(btrtl_dev->fw_data);
+       kvfree(btrtl_dev->cfg_data);
        kfree(btrtl_dev);
 }
 EXPORT_SYMBOL_GPL(btrtl_free);