Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit eb771e2c authored by Johan Hovold's avatar Johan Hovold Committed by Greg Kroah-Hartman
Browse files

USB: mos7720: fix DMA buffers on stack and clean up send_mos_cmd 



Change data-argument type from (void *) to (u8 *) to prevent endianess
problems.

Signed-off-by: default avatarJohan Hovold <jhovold@gmail.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@suse.de>
parent abf492e7

drivers/usb/serial/mos7720.c

+17 −17
Original line number Diff line number Diff line
@@ -275,13 +275,11 @@ static void mos7720_bulk_out_data_callback(struct urb *urb) 
 *	this function will be used for sending command to device

 */

static int send_mos_cmd(struct usb_serial *serial, __u8 request, __u16 value,

			__u16 index, void *data)

			__u16 index, u8 *data)

{

	int status;

	unsigned int pipe;

	u8 *buf;

	u16 product = le16_to_cpu(serial->dev->descriptor.idProduct);

	__u8 requesttype;

	__u16 size = 0x0000;



	if (value < MOS_MAX_PORT) {

		if (product == MOSCHIP_DEVICE_ID_7715)
@@ -298,21 +296,23 @@ static int send_mos_cmd(struct usb_serial *serial, __u8 request, __u16 value, 
	}



	if (request == MOS_WRITE) {

		request = (__u8)MOS_WRITE;

		requesttype = (__u8)0x40;

		value  = value + (__u16)*((unsigned char *)data);

		data = NULL;

		pipe = usb_sndctrlpipe(serial->dev, 0);

		value = value + *data;

		status = usb_control_msg(serial->dev,

				usb_sndctrlpipe(serial->dev, 0), MOS_WRITE,

				0x40, value, index, NULL, 0, MOS_WDR_TIMEOUT);

	} else {

		request = (__u8)MOS_READ;

		requesttype = (__u8)0xC0;

		size = 0x01;

		pipe = usb_rcvctrlpipe(serial->dev, 0);

	}



	status = usb_control_msg(serial->dev, pipe, request, requesttype,

				 value, index, data, size, MOS_WDR_TIMEOUT);



		buf = kmalloc(1, GFP_KERNEL);

		if (!buf) {

			status = -ENOMEM;

			goto out;

		}

		status = usb_control_msg(serial->dev,

				usb_rcvctrlpipe(serial->dev, 0), MOS_READ,

				0xc0, value, index, buf, 1, MOS_WDR_TIMEOUT);

		*data = *buf;

		kfree(buf);

	}

out:

	if (status < 0)

		dbg("Command Write failed Value %x index %x\n", value, index);