Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit c8afd85b authored by Maksim Salau's avatar Maksim Salau Committed by Greg Kroah-Hartman
Browse files

usb: misc: legousbtower: Fix buffers on stack 



commit 942a48730faf149ccbf3e12ac718aee120bb3529 upstream.

Allocate buffers on HEAP instead of STACK for local structures
that are to be received using usb_control_msg().

Signed-off-by: default avatarMaksim Salau <maksim.salau@gmail.com>
Tested-by: default avatarAlfredo Rafael Vicente Boix <alviboi@gmail.com&gt;;>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 1a39dd09

drivers/usb/misc/legousbtower.c

+27 −10
Original line number Diff line number Diff line
@@ -317,9 +317,16 @@ static int tower_open (struct inode *inode, struct file *file) 
	int subminor;

	int retval = 0;

	struct usb_interface *interface;

	struct tower_reset_reply reset_reply;

	struct tower_reset_reply *reset_reply;

	int result;



	reset_reply = kmalloc(sizeof(*reset_reply), GFP_KERNEL);



	if (!reset_reply) {

		retval = -ENOMEM;

		goto exit;

	}



	nonseekable_open(inode, file);

	subminor = iminor(inode);
@@ -364,8 +371,8 @@ static int tower_open (struct inode *inode, struct file *file) 
				  USB_TYPE_VENDOR | USB_DIR_IN | USB_RECIP_DEVICE,

				  0,

				  0,

				  &reset_reply,

				  sizeof(reset_reply),

				  reset_reply,

				  sizeof(*reset_reply),

				  1000);

	if (result < 0) {

		dev_err(&dev->udev->dev,
@@ -406,6 +413,7 @@ unlock_exit: 
	mutex_unlock(&dev->lock);



exit:

	kfree(reset_reply);

	return retval;

}
@@ -808,7 +816,7 @@ static int tower_probe (struct usb_interface *interface, const struct usb_device 
	struct lego_usb_tower *dev = NULL;

	struct usb_host_interface *iface_desc;

	struct usb_endpoint_descriptor* endpoint;

	struct tower_get_version_reply get_version_reply;

	struct tower_get_version_reply *get_version_reply = NULL;

	int i;

	int retval = -ENOMEM;

	int result;
@@ -916,6 +924,13 @@ static int tower_probe (struct usb_interface *interface, const struct usb_device 
		 "%d minor %d\n", (dev->minor - LEGO_USB_TOWER_MINOR_BASE),

		 USB_MAJOR, dev->minor);



	get_version_reply = kmalloc(sizeof(*get_version_reply), GFP_KERNEL);



	if (!get_version_reply) {

		retval = -ENOMEM;

		goto error;

	}



	/* get the firmware version and log it */

	result = usb_control_msg (udev,

				  usb_rcvctrlpipe(udev, 0),
@@ -923,24 +938,26 @@ static int tower_probe (struct usb_interface *interface, const struct usb_device 
				  USB_TYPE_VENDOR | USB_DIR_IN | USB_RECIP_DEVICE,

				  0,

				  0,

				  &get_version_reply,

				  sizeof(get_version_reply),

				  get_version_reply,

				  sizeof(*get_version_reply),

				  1000);

	if (result < 0) {

		dev_err(idev, "LEGO USB Tower get version control request failed\n");

		retval = result;

		goto error;

	}

	dev_info(&interface->dev, "LEGO USB Tower firmware version is %d.%d "

		 "build %d\n", get_version_reply.major,

		 get_version_reply.minor,

		 le16_to_cpu(get_version_reply.build_no));

	dev_info(&interface->dev,

		 "LEGO USB Tower firmware version is %d.%d build %d\n",

		 get_version_reply->major,

		 get_version_reply->minor,

		 le16_to_cpu(get_version_reply->build_no));





exit:

	return retval;



error:

	kfree(get_version_reply);

	tower_delete(dev);

	return retval;

}