Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 2f6ae79c authored by Maksim Salau's avatar Maksim Salau Committed by Kalle Valo
Browse files

orinoco_usb: Fix buffer on stack 



Allocate buffer on HEAP instead of STACK for a local variable
that is to be sent using usb_control_msg().

Signed-off-by: default avatarMaksim Salau <maksim.salau@gmail.com>
Signed-off-by: default avatarKalle Valo <kvalo@codeaurora.org>
parent bea35f90

drivers/net/wireless/intersil/orinoco/orinoco_usb.c

+17 −4
Original line number Original line Diff line number Diff line
@@ -769,18 +769,31 @@ static int ezusb_submit_in_urb(struct ezusb_priv *upriv) 




static inline int ezusb_8051_cpucs(struct ezusb_priv *upriv, int reset)

static inline int ezusb_8051_cpucs(struct ezusb_priv *upriv, int reset)

{

{

	u8 res_val = reset;	/* avoid argument promotion */

	int ret;

	u8 *res_val = NULL;





	if (!upriv->udev) {

	if (!upriv->udev) {

		err("%s: !upriv->udev", __func__);

		err("%s: !upriv->udev", __func__);

		return -EFAULT;

		return -EFAULT;

	}

	}

	return usb_control_msg(upriv->udev,



	res_val = kmalloc(sizeof(*res_val), GFP_KERNEL);



	if (!res_val)

		return -ENOMEM;



	*res_val = reset;	/* avoid argument promotion */



	ret =  usb_control_msg(upriv->udev,

			       usb_sndctrlpipe(upriv->udev, 0),

			       usb_sndctrlpipe(upriv->udev, 0),

			       EZUSB_REQUEST_FW_TRANS,

			       EZUSB_REQUEST_FW_TRANS,

			       USB_TYPE_VENDOR | USB_RECIP_DEVICE |

			       USB_TYPE_VENDOR | USB_RECIP_DEVICE |

			       USB_DIR_OUT, EZUSB_CPUCS_REG, 0, &res_val,

			       USB_DIR_OUT, EZUSB_CPUCS_REG, 0, res_val,

			       sizeof(res_val), DEF_TIMEOUT);

			       sizeof(*res_val), DEF_TIMEOUT);



	kfree(res_val);



	return ret;

}

}





static int ezusb_firmware_download(struct ezusb_priv *upriv,

static int ezusb_firmware_download(struct ezusb_priv *upriv,