{
        int r;
        int i;
-       zd_addr_t *a16;
-       u16 *v16;
+       zd_addr_t a16[USB_MAX_IOREAD32_COUNT * 2];
+       u16 v16[USB_MAX_IOREAD32_COUNT * 2];
        unsigned int count16;
 
        if (count > USB_MAX_IOREAD32_COUNT)
                return -EINVAL;
 
-       /* Allocate a single memory block for values and addresses. */
-       count16 = 2*count;
-       /* zd_addr_t is __nocast, so the kmalloc needs an explicit cast */
-       a16 = (zd_addr_t *) kmalloc(count16 * (sizeof(zd_addr_t) + sizeof(u16)),
-                                  GFP_KERNEL);
-       if (!a16) {
-               dev_dbg_f(zd_chip_dev(chip),
-                         "error ENOMEM in allocation of a16\n");
-               r = -ENOMEM;
-               goto out;
-       }
-       v16 = (u16 *)(a16 + count16);
+       /* Use stack for values and addresses. */
+       count16 = 2 * count;
+       BUG_ON(count16 * sizeof(zd_addr_t) > sizeof(a16));
+       BUG_ON(count16 * sizeof(u16) > sizeof(v16));
 
        for (i = 0; i < count; i++) {
                int j = 2*i;
        if (r) {
                dev_dbg_f(zd_chip_dev(chip),
                          "error: zd_ioread16v_locked. Error number %d\n", r);
-               goto out;
+               return r;
        }
 
        for (i = 0; i < count; i++) {
                values[i] = (v16[j] << 16) | v16[j+1];
        }
 
-out:
-       kfree((void *)a16);
-       return r;
+       return 0;
 }
 
 int _zd_iowrite32v_locked(struct zd_chip *chip, const struct zd_ioreq32 *ioreqs,
                   unsigned int count)
 {
        int i, j, r;
-       struct zd_ioreq16 *ioreqs16;
+       struct zd_ioreq16 ioreqs16[USB_MAX_IOWRITE32_COUNT * 2];
        unsigned int count16;
 
+       /* Use stack for values and addresses. */
+
        ZD_ASSERT(mutex_is_locked(&chip->mutex));
 
        if (count == 0)
        if (count > USB_MAX_IOWRITE32_COUNT)
                return -EINVAL;
 
-       /* Allocate a single memory block for values and addresses. */
-       count16 = 2*count;
-       ioreqs16 = kmalloc(count16 * sizeof(struct zd_ioreq16), GFP_KERNEL);
-       if (!ioreqs16) {
-               r = -ENOMEM;
-               dev_dbg_f(zd_chip_dev(chip),
-                         "error %d in ioreqs16 allocation\n", r);
-               goto out;
-       }
+       count16 = 2 * count;
+       BUG_ON(count16 * sizeof(struct zd_ioreq16) > sizeof(ioreqs16));
 
        for (i = 0; i < count; i++) {
                j = 2*i;
                          "error %d in zd_usb_write16v\n", r);
        }
 #endif /* DEBUG */
-out:
-       kfree(ioreqs16);
        return r;
 }
 
 
                return -EWOULDBLOCK;
        }
        if (!usb_int_enabled(usb)) {
-                dev_dbg_f(zd_usb_dev(usb),
+               dev_dbg_f(zd_usb_dev(usb),
                          "error: usb interrupt not enabled\n");
                return -EWOULDBLOCK;
        }
 
+       ZD_ASSERT(mutex_is_locked(&zd_usb_to_chip(usb)->mutex));
+       BUILD_BUG_ON(sizeof(struct usb_req_read_regs) + USB_MAX_IOREAD16_COUNT *
+                    sizeof(__le16) > sizeof(usb->req_buf));
+       BUG_ON(sizeof(struct usb_req_read_regs) + count * sizeof(__le16) >
+              sizeof(usb->req_buf));
+
        req_len = sizeof(struct usb_req_read_regs) + count * sizeof(__le16);
-       req = kmalloc(req_len, GFP_KERNEL);
-       if (!req)
-               return -ENOMEM;
+       req = (void *)usb->req_buf;
+
        req->id = cpu_to_le16(USB_REQ_READ_REGS);
        for (i = 0; i < count; i++)
                req->addr[i] = cpu_to_le16((u16)addresses[i]);
 
        r = get_results(usb, values, req, count);
 error:
-       kfree(req);
        return r;
 }
 
                return -EWOULDBLOCK;
        }
 
+       ZD_ASSERT(mutex_is_locked(&zd_usb_to_chip(usb)->mutex));
+       BUILD_BUG_ON(sizeof(struct usb_req_write_regs) +
+                    USB_MAX_IOWRITE16_COUNT * sizeof(struct reg_data) >
+                    sizeof(usb->req_buf));
+       BUG_ON(sizeof(struct usb_req_write_regs) +
+              count * sizeof(struct reg_data) >
+              sizeof(usb->req_buf));
+
        req_len = sizeof(struct usb_req_write_regs) +
                  count * sizeof(struct reg_data);
-       req = kmalloc(req_len, GFP_KERNEL);
-       if (!req)
-               return -ENOMEM;
+       req = (void *)usb->req_buf;
 
        req->id = cpu_to_le16(USB_REQ_WRITE_REGS);
        for (i = 0; i < count; i++) {
 
        /* FALL-THROUGH with r == 0 */
 error:
-       kfree(req);
        return r;
 }
 
        if (r) {
                dev_dbg_f(zd_usb_dev(usb),
                        "error %d: Couldn't read CR203\n", r);
-               goto out;
+               return r;
        }
        bit_value_template &= ~(RF_IF_LE|RF_CLK|RF_DATA);
 
+       ZD_ASSERT(mutex_is_locked(&zd_usb_to_chip(usb)->mutex));
+       BUILD_BUG_ON(sizeof(struct usb_req_rfwrite) +
+                    USB_MAX_RFWRITE_BIT_COUNT * sizeof(__le16) >
+                    sizeof(usb->req_buf));
+       BUG_ON(sizeof(struct usb_req_rfwrite) + bits * sizeof(__le16) >
+              sizeof(usb->req_buf));
+
        req_len = sizeof(struct usb_req_rfwrite) + bits * sizeof(__le16);
-       req = kmalloc(req_len, GFP_KERNEL);
-       if (!req)
-               return -ENOMEM;
+       req = (void *)usb->req_buf;
 
        req->id = cpu_to_le16(USB_REQ_WRITE_RF);
        /* 1: 3683a, but not used in ZYDAS driver */
 
        /* FALL-THROUGH with r == 0 */
 out:
-       kfree(req);
        return r;
 }