Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 4898e071 authored by jwboyer@redhat.com's avatar jwboyer@redhat.com Committed by Greg Kroah-Hartman
Browse files

USB: ums_realtek: do not use stack memory for DMA in __do_config_autodelink 



__do_config_autodelink passes the data variable to the transport function.
If the calling functions pass a stack variable, this will eventually trigger
a DMA-API debug backtrace for mapping stack memory in the DMA buffer.  Fix
this by calling kmemdup for the passed data instead.

Signed-off-by: default avatarJosh Boyer <jwboyer@redhat.com>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 28c56ea1

drivers/usb/storage/realtek_cr.c

+7 −1
Original line number Diff line number Diff line
@@ -507,9 +507,14 @@ static int __do_config_autodelink(struct us_data *us, u8 *data, u16 len) 
{

	int retval;

	u8 cmnd[12] = {0};

	u8 *buf;



	US_DEBUGP("%s, addr = 0xfe47, len = %d\n", __FUNCTION__, len);



	buf = kmemdup(data, len, GFP_NOIO);

	if (!buf)

		return USB_STOR_TRANSPORT_ERROR;



	cmnd[0] = 0xF0;

	cmnd[1] = 0x0E;

	cmnd[2] = 0xfe;
@@ -517,7 +522,8 @@ static int __do_config_autodelink(struct us_data *us, u8 *data, u16 len) 
	cmnd[4] = (u8)(len >> 8);

	cmnd[5] = (u8)len;



	retval = rts51x_bulk_transport_special(us, 0, cmnd, 12, data, len, DMA_TO_DEVICE, NULL);

	retval = rts51x_bulk_transport_special(us, 0, cmnd, 12, buf, len, DMA_TO_DEVICE, NULL);

	kfree(buf);

	if (retval != USB_STOR_TRANSPORT_GOOD) {

		return -EIO;

	}