Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit d49c3d61 authored by Kumar Amit Mehta's avatar Kumar Amit Mehta Committed by Greg Kroah-Hartman
Browse files

staging: comedi: drivers: usbdux.c: fix DMA buffers on stack 



fix for instances of DMA buffer on stack(being passed to usb_control_msg) for
the USB-DUX-D Board driver.

Signed-off-by: default avatarKumar Amit Mehta <gmate.amit@gmail.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 6987a6da

drivers/staging/comedi/drivers/usbdux.c

+19 −12
Original line number Diff line number Diff line
@@ -730,10 +730,14 @@ static void usbduxsub_ao_IsocIrq(struct urb *urb) 
static int usbduxsub_start(struct usbduxsub *usbduxsub)

{

	int errcode = 0;

	uint8_t local_transfer_buffer[16];

	uint8_t *local_transfer_buffer;



	local_transfer_buffer = kmalloc(1, GFP_KERNEL);

	if (!local_transfer_buffer)

		return -ENOMEM;



	/* 7f92 to zero */

	local_transfer_buffer[0] = 0;

	*local_transfer_buffer = 0;

	errcode = usb_control_msg(usbduxsub->usbdev,

				  /* create a pipe for a control transfer */

				  usb_sndctrlpipe(usbduxsub->usbdev, 0),
@@ -751,22 +755,25 @@ static int usbduxsub_start(struct usbduxsub *usbduxsub) 
				  1,

				  /* Timeout */

				  BULK_TIMEOUT);

	if (errcode < 0) {

	if (errcode < 0)

		dev_err(&usbduxsub->interface->dev,

			"comedi_: control msg failed (start)\n");



	kfree(local_transfer_buffer);

	return errcode;

}

	return 0;

}



static int usbduxsub_stop(struct usbduxsub *usbduxsub)

{

	int errcode = 0;

	uint8_t *local_transfer_buffer;



	uint8_t local_transfer_buffer[16];

	local_transfer_buffer = kmalloc(1, GFP_KERNEL);

	if (!local_transfer_buffer)

		return -ENOMEM;



	/* 7f92 to one */

	local_transfer_buffer[0] = 1;

	*local_transfer_buffer = 1;

	errcode = usb_control_msg(usbduxsub->usbdev,

				  usb_sndctrlpipe(usbduxsub->usbdev, 0),

				  /* bRequest, "Firmware" */
@@ -781,13 +788,13 @@ static int usbduxsub_stop(struct usbduxsub *usbduxsub) 
				  1,

				  /* Timeout */

				  BULK_TIMEOUT);

	if (errcode < 0) {

	if (errcode < 0)

		dev_err(&usbduxsub->interface->dev,

			"comedi_: control msg failed (stop)\n");



	kfree(local_transfer_buffer);

	return errcode;

}

	return 0;

}



static int usbduxsub_upload(struct usbduxsub *usbduxsub,

			    uint8_t *local_transfer_buffer,