Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 0954644b authored by Johan Hovold's avatar Johan Hovold Committed by Greg Kroah-Hartman
Browse files

USB: cypress_m8: fix DMA buffer on stack 



Cc: Lonnie Mendez <dignome@gmail.com>
Signed-off-by: default avatarJohan Hovold <jhovold@gmail.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@suse.de>
parent 52372ccb

drivers/usb/serial/cypress_m8.c

+17 −14
Original line number Original line Diff line number Diff line
@@ -344,7 +344,8 @@ static int cypress_serial_control(struct tty_struct *tty, 
{

{

	int new_baudrate = 0, retval = 0, tries = 0;

	int new_baudrate = 0, retval = 0, tries = 0;

	struct cypress_private *priv;

	struct cypress_private *priv;

	__u8 feature_buffer[5];

	u8 *feature_buffer;

	const unsigned int feature_len = 5;

	unsigned long flags;

	unsigned long flags;





	dbg("%s", __func__);

	dbg("%s", __func__);
@@ -354,6 +355,10 @@ static int cypress_serial_control(struct tty_struct *tty, 
	if (!priv->comm_is_ok)

	if (!priv->comm_is_ok)

		return -ENODEV;

		return -ENODEV;





	feature_buffer = kcalloc(feature_len, sizeof(u8), GFP_KERNEL);

	if (!feature_buffer)

		return -ENOMEM;



	switch (cypress_request_type) {

	switch (cypress_request_type) {

	case CYPRESS_SET_CONFIG:

	case CYPRESS_SET_CONFIG:

		/* 0 means 'Hang up' so doesn't change the true bit rate */

		/* 0 means 'Hang up' so doesn't change the true bit rate */
@@ -370,7 +375,6 @@ static int cypress_serial_control(struct tty_struct *tty, 
		dbg("%s - baud rate is being sent as %d",

		dbg("%s - baud rate is being sent as %d",

					__func__, new_baudrate);

					__func__, new_baudrate);





		memset(feature_buffer, 0, sizeof(feature_buffer));

		/* fill the feature_buffer with new configuration */

		/* fill the feature_buffer with new configuration */

		*((u_int32_t *)feature_buffer) = new_baudrate;

		*((u_int32_t *)feature_buffer) = new_baudrate;

		feature_buffer[4] |= data_bits;   /* assign data bits in 2 bit space ( max 3 ) */

		feature_buffer[4] |= data_bits;   /* assign data bits in 2 bit space ( max 3 ) */
@@ -394,15 +398,15 @@ static int cypress_serial_control(struct tty_struct *tty, 
					HID_REQ_SET_REPORT,

					HID_REQ_SET_REPORT,

					USB_DIR_OUT | USB_RECIP_INTERFACE | USB_TYPE_CLASS,

					USB_DIR_OUT | USB_RECIP_INTERFACE | USB_TYPE_CLASS,

					0x0300, 0, feature_buffer,

					0x0300, 0, feature_buffer,

					sizeof(feature_buffer), 500);

					feature_len, 500);





			if (tries++ >= 3)

			if (tries++ >= 3)

				break;

				break;





		} while (retval != sizeof(feature_buffer) &&

		} while (retval != feature_len &&

			 retval != -ENODEV);

			 retval != -ENODEV);





		if (retval != sizeof(feature_buffer)) {

		if (retval != feature_len) {

			dev_err(&port->dev, "%s - failed sending serial "

			dev_err(&port->dev, "%s - failed sending serial "

				"line settings - %d\n", __func__, retval);

				"line settings - %d\n", __func__, retval);

			cypress_set_dead(port);

			cypress_set_dead(port);
@@ -422,30 +426,28 @@ static int cypress_serial_control(struct tty_struct *tty, 
			/* Not implemented for this device,

			/* Not implemented for this device,

			   and if we try to do it we're likely

			   and if we try to do it we're likely

			   to crash the hardware. */

			   to crash the hardware. */

			return -ENOTTY;

			retval = -ENOTTY;

			goto out;

		}

		}

		dbg("%s - retreiving serial line settings", __func__);

		dbg("%s - retreiving serial line settings", __func__);

		/* set initial values in feature buffer */

		memset(feature_buffer, 0, sizeof(feature_buffer));



		do {

		do {

			retval = usb_control_msg(port->serial->dev,

			retval = usb_control_msg(port->serial->dev,

					usb_rcvctrlpipe(port->serial->dev, 0),

					usb_rcvctrlpipe(port->serial->dev, 0),

					HID_REQ_GET_REPORT,

					HID_REQ_GET_REPORT,

					USB_DIR_IN | USB_RECIP_INTERFACE | USB_TYPE_CLASS,

					USB_DIR_IN | USB_RECIP_INTERFACE | USB_TYPE_CLASS,

					0x0300, 0, feature_buffer,

					0x0300, 0, feature_buffer,

					sizeof(feature_buffer), 500);

					feature_len, 500);





			if (tries++ >= 3)

			if (tries++ >= 3)

				break;

				break;

		} while (retval != sizeof(feature_buffer)

		} while (retval != feature_len

						&& retval != -ENODEV);

						&& retval != -ENODEV);





		if (retval != sizeof(feature_buffer)) {

		if (retval != feature_len) {

			dev_err(&port->dev, "%s - failed to retrieve serial "

			dev_err(&port->dev, "%s - failed to retrieve serial "

				"line settings - %d\n", __func__, retval);

				"line settings - %d\n", __func__, retval);

			cypress_set_dead(port);

			cypress_set_dead(port);

			return retval;

			goto out;

		} else {

		} else {

			spin_lock_irqsave(&priv->lock, flags);

			spin_lock_irqsave(&priv->lock, flags);

			/* store the config in one byte, and later

			/* store the config in one byte, and later
@@ -458,7 +460,8 @@ static int cypress_serial_control(struct tty_struct *tty, 
	spin_lock_irqsave(&priv->lock, flags);

	spin_lock_irqsave(&priv->lock, flags);

	++priv->cmd_count;

	++priv->cmd_count;

	spin_unlock_irqrestore(&priv->lock, flags);

	spin_unlock_irqrestore(&priv->lock, flags);



out:

	kfree(feature_buffer);

	return retval;

	return retval;

} /* cypress_serial_control */

} /* cypress_serial_control */