Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 28d1e8b7 authored by Stefan Brüns's avatar Stefan Brüns Committed by Greg Kroah-Hartman
Browse files

dvb-usb-firmware: don't do DMA on stack 



commit 67b0503db9c29b04eadfeede6bebbfe5ddad94ef upstream.

The buffer allocation for the firmware data was changed in
commit 43fab9793c1f ("[media] dvb-usb: don't use stack for firmware load")
but the same applies for the reset value.

Fixes: 43fab9793c1f ("[media] dvb-usb: don't use stack for firmware load")
Signed-off-by: default avatarStefan Brüns <stefan.bruens@rwth-aachen.de>
Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@s-opensource.com>
Cc: Ben Hutchings <ben@decadent.org.uk>
Cc: Brad Spengler <spender@grsecurity.net>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 36b62c08

drivers/media/usb/dvb-usb/dvb-usb-firmware.c

+12 −10
Original line number Diff line number Diff line
@@ -36,16 +36,18 @@ static int usb_cypress_writemem(struct usb_device *udev,u16 addr,u8 *data, u8 le 
int usb_cypress_load_firmware(struct usb_device *udev, const struct firmware *fw, int type)

{

	struct hexline *hx;

	u8 reset;

	u8 *buf;

	int ret, pos = 0;

	u16 cpu_cs_register = cypress[type].cpu_cs_register;



	hx = kmalloc(sizeof(*hx), GFP_KERNEL);

	if (!hx)

	buf = kmalloc(sizeof(*hx), GFP_KERNEL);

	if (!buf)

		return -ENOMEM;

	hx = (struct hexline *)buf;



	/* stop the CPU */

	reset = 1;

	if ((ret = usb_cypress_writemem(udev,cypress[type].cpu_cs_register,&reset,1)) != 1)

	buf[0] = 1;

	if (usb_cypress_writemem(udev, cpu_cs_register, buf, 1) != 1)

		err("could not stop the USB controller CPU.");



	while ((ret = dvb_usb_get_hexline(fw, hx, &pos)) > 0) {
@@ -62,21 +64,21 @@ int usb_cypress_load_firmware(struct usb_device *udev, const struct firmware *fw 
	}

	if (ret < 0) {

		err("firmware download failed at %d with %d",pos,ret);

		kfree(hx);

		kfree(buf);

		return ret;

	}



	if (ret == 0) {

		/* restart the CPU */

		reset = 0;

		if (ret || usb_cypress_writemem(udev,cypress[type].cpu_cs_register,&reset,1) != 1) {

		buf[0] = 0;

		if (usb_cypress_writemem(udev, cpu_cs_register, buf, 1) != 1) {

			err("could not restart the USB controller CPU.");

			ret = -EINVAL;

		}

	} else

		ret = -EIO;



	kfree(hx);

	kfree(buf);



	return ret;

}