Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit e75dc677 authored by Daniel Gimpelevich's avatar Daniel Gimpelevich Committed by David S. Miller
Browse files

hso: Fix stack corruption on some architectures 



As Sergei Shtylyov explained in the #mipslinux IRC channel:
[Mon 2013-08-19 12:28:21 PM PDT] <headless> guys, are you sure it's not "DMA off stack" case?
[Mon 2013-08-19 12:28:35 PM PDT] <headless> it's a known stack corruptor on non-coherent arches
[Mon 2013-08-19 12:31:48 PM PDT] <DonkeyHotei> headless: for usb/ehci?
[Mon 2013-08-19 12:34:11 PM PDT] <DonkeyHotei> headless: explain
[Mon 2013-08-19 12:35:38 PM PDT] <headless> usb_control_msg() (or other such func) should not use buffer on stack. DMA from/to stack is prohibited
[Mon 2013-08-19 12:35:58 PM PDT] <headless> and EHCI uses DMA on control xfers (as well as all the others)

Signed-off-by: default avatarDaniel Gimpelevich <daniel@gimpelevich.san-francisco.ca.us>
Acked-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 35e57e1b

drivers/net/usb/hso.c

+5 −1
Original line number Diff line number Diff line
@@ -2816,13 +2816,16 @@ struct hso_shared_int *hso_create_shared_int(struct usb_interface *interface) 
static int hso_get_config_data(struct usb_interface *interface)

{

	struct usb_device *usbdev = interface_to_usbdev(interface);

	u8 config_data[17];

	u8 *config_data = kmalloc(17, GFP_KERNEL);

	u32 if_num = interface->altsetting->desc.bInterfaceNumber;

	s32 result;



	if (!config_data)

		return -ENOMEM;

	if (usb_control_msg(usbdev, usb_rcvctrlpipe(usbdev, 0),

			    0x86, 0xC0, 0, 0, config_data, 17,

			    USB_CTRL_SET_TIMEOUT) != 0x11) {

		kfree(config_data);

		return -EIO;

	}
@@ -2873,6 +2876,7 @@ static int hso_get_config_data(struct usb_interface *interface) 
	if (config_data[16] & 0x1)

		result |= HSO_INFO_CRC_BUG;



	kfree(config_data);

	return result;

}