greybus: fix uart request_operation()

This fixes a problem similar to what was found in the battery
protcool driver code.

There's no need to allocate a local buffer, that already set up
by gb_operation_create().  Just use that instead.

Change a few variable names to reflect that they hold response
messages, not request messages.
Signed-off-by: Alex Elder <elder@linaro.org>
Signed-off-by: Greg Kroah-Hartman <greg@kroah.com>

drivers/staging/greybus/uart-gb.c

@@ -144,19 +144,12 @@ static int request_operation(struct gb_connection *connection, int type,
 			     void *response, int response_size)
 {
 	struct gb_operation *operation;
-	struct gb_uart_simple_response *fake_request;
-	u8 *local_response;
+	struct gb_uart_simple_response *fake_response;
 	int ret;
 
-	local_response = kmalloc(response_size, GFP_KERNEL);
-	if (!local_response)
-		return -ENOMEM;
-
 	operation = gb_operation_create(connection, type, 0, response_size);
-	if (!operation) {
-		kfree(local_response);
+	if (!operation)
 		return -ENOMEM;
-	}
 
 	/* Synchronous operation--no callback */
 	ret = gb_operation_request_send(operation, NULL);
@@ -170,19 +163,18 @@ static int request_operation(struct gb_connection *connection, int type,
 	 * layout for where the status is, so cast this to a random request so
 	 * we can see the status easier.
 	 */
-	fake_request = (struct gb_uart_simple_response *)local_response;
-	if (fake_request->status) {
+	fake_response = operation->response.payload;
+	if (fake_response->status) {
 		gb_connection_err(connection, "response %hhu",
-			fake_request->status);
+			fake_response->status);
 		ret = -EIO;
 	} else {
 		/* Good request, so copy to the caller's buffer */
 		if (response_size && response)
-			memcpy(response, local_response, response_size);
+			memcpy(response, fake_response, response_size);
 	}
 out:
 	gb_operation_destroy(operation);
-	kfree(local_response);
 
 	return ret;
 }
@@ -193,23 +185,23 @@ static int request_operation(struct gb_connection *connection, int type,
  */
 static int get_version(struct gb_tty *tty)
 {
-	struct gb_uart_proto_version_response version_request;
+	struct gb_uart_proto_version_response version_response;
 	int retval;
 
 	retval = request_operation(tty->connection,
 				   GB_UART_REQ_PROTOCOL_VERSION,
-				   &version_request, sizeof(version_request));
+				   &version_response, sizeof(version_response));
 	if (retval)
 		return retval;
 
-	if (version_request.major > GB_UART_VERSION_MAJOR) {
+	if (version_response.major > GB_UART_VERSION_MAJOR) {
 		pr_err("unsupported major version (%hhu > %hhu)\n",
-			version_request.major, GB_UART_VERSION_MAJOR);
+			version_response.major, GB_UART_VERSION_MAJOR);
 		return -ENOTSUPP;
 	}
 
-	tty->version_major = version_request.major;
-	tty->version_minor = version_request.minor;
+	tty->version_major = version_response.major;
+	tty->version_minor = version_response.minor;
 	return 0;
 }