Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 4684be16 authored by Maksim Salau's avatar Maksim Salau Committed by Greg Kroah-Hartman
Browse files

net: can: usb: gs_usb: Fix buffer on stack 



commit b05c73bd1e3ec60357580eb042ee932a5ed754d5 upstream.

Allocate buffers on HEAP instead of STACK for local structures
that are to be sent using usb_control_msg().

Signed-off-by: default avatarMaksim Salau <maksim.salau@gmail.com>
Signed-off-by: default avatarMarc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 07389a14

drivers/net/can/usb/gs_usb.c

+12 −5
Original line number Diff line number Diff line
@@ -740,13 +740,18 @@ static const struct net_device_ops gs_usb_netdev_ops = { 
static int gs_usb_set_identify(struct net_device *netdev, bool do_identify)

{

	struct gs_can *dev = netdev_priv(netdev);

	struct gs_identify_mode imode;

	struct gs_identify_mode *imode;

	int rc;



	imode = kmalloc(sizeof(*imode), GFP_KERNEL);



	if (!imode)

		return -ENOMEM;



	if (do_identify)

		imode.mode = GS_CAN_IDENTIFY_ON;

		imode->mode = GS_CAN_IDENTIFY_ON;

	else

		imode.mode = GS_CAN_IDENTIFY_OFF;

		imode->mode = GS_CAN_IDENTIFY_OFF;



	rc = usb_control_msg(interface_to_usbdev(dev->iface),

			     usb_sndctrlpipe(interface_to_usbdev(dev->iface),
@@ -756,10 +761,12 @@ static int gs_usb_set_identify(struct net_device *netdev, bool do_identify) 
			     USB_RECIP_INTERFACE,

			     dev->channel,

			     0,

			     &imode,

			     sizeof(imode),

			     imode,

			     sizeof(*imode),

			     100);



	kfree(imode);



	return (rc > 0) ? 0 : rc;

}