Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 942a4873 authored by Maksim Salau's avatar Maksim Salau Committed by Greg Kroah-Hartman
Browse files

usb: misc: legousbtower: Fix buffers on stack 



Allocate buffers on HEAP instead of STACK for local structures
that are to be received using usb_control_msg().

Signed-off-by: default avatarMaksim Salau <maksim.salau@gmail.com>
Tested-by: default avatarAlfredo Rafael Vicente Boix <alviboi@gmail.com&gt;;>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 19445816

drivers/usb/misc/legousbtower.c

+27 −10
Original line number Diff line number Diff line
@@ -317,9 +317,16 @@ static int tower_open (struct inode *inode, struct file *file) 
	int subminor;

	int retval = 0;

	struct usb_interface *interface;

	struct tower_reset_reply reset_reply;

	struct tower_reset_reply *reset_reply;

	int result;



	reset_reply = kmalloc(sizeof(*reset_reply), GFP_KERNEL);



	if (!reset_reply) {

		retval = -ENOMEM;

		goto exit;

	}



	nonseekable_open(inode, file);

	subminor = iminor(inode);
@@ -364,8 +371,8 @@ static int tower_open (struct inode *inode, struct file *file) 
				  USB_TYPE_VENDOR | USB_DIR_IN | USB_RECIP_DEVICE,

				  0,

				  0,

				  &reset_reply,

				  sizeof(reset_reply),

				  reset_reply,

				  sizeof(*reset_reply),

				  1000);

	if (result < 0) {

		dev_err(&dev->udev->dev,
@@ -406,6 +413,7 @@ static int tower_open (struct inode *inode, struct file *file) 
	mutex_unlock(&dev->lock);



exit:

	kfree(reset_reply);

	return retval;

}
@@ -806,7 +814,7 @@ static int tower_probe (struct usb_interface *interface, const struct usb_device 
	struct device *idev = &interface->dev;

	struct usb_device *udev = interface_to_usbdev(interface);

	struct lego_usb_tower *dev = NULL;

	struct tower_get_version_reply get_version_reply;

	struct tower_get_version_reply *get_version_reply = NULL;

	int retval = -ENOMEM;

	int result;
@@ -871,6 +879,13 @@ static int tower_probe (struct usb_interface *interface, const struct usb_device 
	dev->interrupt_in_interval = interrupt_in_interval ? interrupt_in_interval : dev->interrupt_in_endpoint->bInterval;

	dev->interrupt_out_interval = interrupt_out_interval ? interrupt_out_interval : dev->interrupt_out_endpoint->bInterval;



	get_version_reply = kmalloc(sizeof(*get_version_reply), GFP_KERNEL);



	if (!get_version_reply) {

		retval = -ENOMEM;

		goto error;

	}



	/* get the firmware version and log it */

	result = usb_control_msg (udev,

				  usb_rcvctrlpipe(udev, 0),
@@ -878,18 +893,19 @@ static int tower_probe (struct usb_interface *interface, const struct usb_device 
				  USB_TYPE_VENDOR | USB_DIR_IN | USB_RECIP_DEVICE,

				  0,

				  0,

				  &get_version_reply,

				  sizeof(get_version_reply),

				  get_version_reply,

				  sizeof(*get_version_reply),

				  1000);

	if (result < 0) {

		dev_err(idev, "LEGO USB Tower get version control request failed\n");

		retval = result;

		goto error;

	}

	dev_info(&interface->dev, "LEGO USB Tower firmware version is %d.%d "

		 "build %d\n", get_version_reply.major,

		 get_version_reply.minor,

		 le16_to_cpu(get_version_reply.build_no));

	dev_info(&interface->dev,

		 "LEGO USB Tower firmware version is %d.%d build %d\n",

		 get_version_reply->major,

		 get_version_reply->minor,

		 le16_to_cpu(get_version_reply->build_no));



	/* we can register the device now, as it is ready */

	usb_set_intfdata (interface, dev);
@@ -913,6 +929,7 @@ static int tower_probe (struct usb_interface *interface, const struct usb_device 
	return retval;



error:

	kfree(get_version_reply);

	tower_delete(dev);

	return retval;

}