Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 161f440c authored by Kumar Amit Mehta's avatar Kumar Amit Mehta Committed by Greg Kroah-Hartman
Browse files

staging: comedi: drivers: usbduxfast.c: fix for DMA buffers on stack 



fix for instances of DMA buffer on stack(being passed to usb_control_msg) for
the USB-DUXfast Board driver.

Signed-off-by: default avatarKumar Amit Mehta <gmate.amit@gmail.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent d49c3d61

drivers/staging/comedi/drivers/usbduxfast.c

+18 −12
Original line number Diff line number Diff line
@@ -436,10 +436,14 @@ static void usbduxfastsub_ai_Irq(struct urb *urb) 
static int usbduxfastsub_start(struct usbduxfastsub_s *udfs)

{

	int ret;

	unsigned char local_transfer_buffer[16];

	unsigned char *local_transfer_buffer;



	local_transfer_buffer = kmalloc(1, GFP_KERNEL);

	if (!local_transfer_buffer)

		return -ENOMEM;



	/* 7f92 to zero */

	local_transfer_buffer[0] = 0;

	*local_transfer_buffer = 0;

	/* bRequest, "Firmware" */

	ret = usb_control_msg(udfs->usbdev, usb_sndctrlpipe(udfs->usbdev, 0),

			      USBDUXFASTSUB_FIRMWARE,
@@ -450,22 +454,25 @@ static int usbduxfastsub_start(struct usbduxfastsub_s *udfs) 
			      local_transfer_buffer,

			      1,      /* Length */

			      EZTIMEOUT);    /* Timeout */

	if (ret < 0) {

	if (ret < 0)

		dev_err(&udfs->interface->dev,

			"control msg failed (start)\n");

		return ret;

	}



	return 0;

	kfree(local_transfer_buffer);

	return ret;

}



static int usbduxfastsub_stop(struct usbduxfastsub_s *udfs)

{

	int ret;

	unsigned char local_transfer_buffer[16];

	unsigned char *local_transfer_buffer;



	local_transfer_buffer = kmalloc(1, GFP_KERNEL);

	if (!local_transfer_buffer)

		return -ENOMEM;



	/* 7f92 to one */

	local_transfer_buffer[0] = 1;

	*local_transfer_buffer = 1;

	/* bRequest, "Firmware" */

	ret = usb_control_msg(udfs->usbdev, usb_sndctrlpipe(udfs->usbdev, 0),

			      USBDUXFASTSUB_FIRMWARE,
@@ -474,13 +481,12 @@ static int usbduxfastsub_stop(struct usbduxfastsub_s *udfs) 
			      0x0000,	/* Index */

			      local_transfer_buffer, 1,	/* Length */

			      EZTIMEOUT);	/* Timeout */

	if (ret < 0) {

	if (ret < 0)

		dev_err(&udfs->interface->dev,

			"control msg failed (stop)\n");

		return ret;

	}



	return 0;

	kfree(local_transfer_buffer);

	return ret;

}



static int usbduxfastsub_upload(struct usbduxfastsub_s *udfs,