Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 05c0cf88 authored by Malcolm Priestley's avatar Malcolm Priestley Committed by Greg Kroah-Hartman
Browse files

staging: vt6656: use off stack for in buffer USB transfers. 



Since 4.9 mandated USB buffers to be heap allocated. This causes
the driver to fail.

Create buffer for USB transfers.

Signed-off-by: default avatarMalcolm Priestley <tvboxspy@gmail.com>
Cc: <stable@vger.kernel.org> # v4.9+
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 12ecd24e

drivers/staging/vt6656/usbpipe.c

+15 −2
Original line number Original line Diff line number Diff line
@@ -85,15 +85,28 @@ int vnt_control_in(struct vnt_private *priv, u8 request, u16 value, 
		    u16 index, u16 length, u8 *buffer)

		    u16 index, u16 length, u8 *buffer)

{

{

	int status;

	int status;

	u8 *usb_buffer;





	if (test_bit(DEVICE_FLAGS_DISCONNECTED, &priv->flags))

	if (test_bit(DEVICE_FLAGS_DISCONNECTED, &priv->flags))

		return STATUS_FAILURE;

		return STATUS_FAILURE;





	mutex_lock(&priv->usb_lock);

	mutex_lock(&priv->usb_lock);





	usb_buffer = kmalloc(length, GFP_KERNEL);

	if (!usb_buffer) {

		mutex_unlock(&priv->usb_lock);

		return -ENOMEM;

	}



	status = usb_control_msg(priv->usb,

	status = usb_control_msg(priv->usb,

				usb_rcvctrlpipe(priv->usb, 0), request, 0xc0,

				 usb_rcvctrlpipe(priv->usb, 0),

				value, index, buffer, length, USB_CTL_WAIT);

				 request, 0xc0, value,

				 index, usb_buffer, length, USB_CTL_WAIT);



	if (status == length)

		memcpy(buffer, usb_buffer, length);



	kfree(usb_buffer);





	mutex_unlock(&priv->usb_lock);

	mutex_unlock(&priv->usb_lock);