Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit d846b765 authored by Oliver Neukum's avatar Oliver Neukum Committed by Greg Kroah-Hartman
Browse files

USB: usbtmc: fix DMA on stack 



send_request_dev_dep_msg_in() use a buffer allocated on the stack.
Fix by kmalloc()ing the buffer.

Signed-off-by: default avatarOliver Neukum <oneukum@suse.de>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent d1b78100

drivers/usb/class/usbtmc.c

+5 −1
Original line number Diff line number Diff line
@@ -383,9 +383,12 @@ static int usbtmc_ioctl_abort_bulk_out(struct usbtmc_device_data *data) 
static int send_request_dev_dep_msg_in(struct usbtmc_device_data *data, size_t transfer_size)

{

	int retval;

	u8 buffer[USBTMC_HEADER_SIZE];

	u8 *buffer;

	int actual;



	buffer = kmalloc(USBTMC_HEADER_SIZE, GFP_KERNEL);

	if (!buffer)

		return -ENOMEM;

	/* Setup IO buffer for REQUEST_DEV_DEP_MSG_IN message

	 * Refer to class specs for details

	 */
@@ -417,6 +420,7 @@ static int send_request_dev_dep_msg_in(struct usbtmc_device_data *data, size_t t 
	if (!data->bTag)

		data->bTag++;



	kfree(buffer);

	if (retval < 0) {

		dev_err(&data->intf->dev, "usb_bulk_msg in send_request_dev_dep_msg_in() returned %d\n", retval);

		return retval;