Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit b5ae1146 authored by Kumar Amit Mehta's avatar Kumar Amit Mehta Committed by Greg Kroah-Hartman
Browse files

staging: comedi: drivers: usbduxsigma.c: fix DMA buffers on stack 



This patch fixes an instance of DMA buffer on stack(being passed to
usb_control_msg)for the USB-DUXsigma Board driver. Found using smatch.

Signed-off-by: default avatarKumar Amit Mehta <gmate.amit@gmail.com>
Reviewed-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: default avatarIan Abbott <abbotti@mev.co.uk>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 47b1be5c

drivers/staging/comedi/drivers/usbduxsigma.c

+17 −10
Original line number Diff line number Diff line
@@ -681,7 +681,11 @@ static void usbduxsub_ao_IsocIrq(struct urb *urb) 
static int usbduxsub_start(struct usbduxsub *usbduxsub)

{

	int errcode = 0;

	uint8_t local_transfer_buffer[16];

	uint8_t *local_transfer_buffer;



	local_transfer_buffer = kmalloc(16, GFP_KERNEL);

	if (!local_transfer_buffer)

		return -ENOMEM;



	/* 7f92 to zero */

	local_transfer_buffer[0] = 0;
@@ -702,19 +706,22 @@ static int usbduxsub_start(struct usbduxsub *usbduxsub) 
				  1,

				  /* Timeout */

				  BULK_TIMEOUT);

	if (errcode < 0) {

	if (errcode < 0)

		dev_err(&usbduxsub->interface->dev,

			"comedi_: control msg failed (start)\n");



	kfree(local_transfer_buffer);

	return errcode;

}

	return 0;

}



static int usbduxsub_stop(struct usbduxsub *usbduxsub)

{

	int errcode = 0;

	uint8_t *local_transfer_buffer;



	uint8_t local_transfer_buffer[16];

	local_transfer_buffer = kmalloc(16, GFP_KERNEL);

	if (!local_transfer_buffer)

		return -ENOMEM;



	/* 7f92 to one */

	local_transfer_buffer[0] = 1;
@@ -732,13 +739,13 @@ static int usbduxsub_stop(struct usbduxsub *usbduxsub) 
				  1,

				  /* Timeout */

				  BULK_TIMEOUT);

	if (errcode < 0) {

	if (errcode < 0)

		dev_err(&usbduxsub->interface->dev,

			"comedi_: control msg failed (stop)\n");



	kfree(local_transfer_buffer);

	return errcode;

}

	return 0;

}



static int usbduxsub_upload(struct usbduxsub *usbduxsub,

			    uint8_t *local_transfer_buffer,