Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 12ecd24e authored by Malcolm Priestley's avatar Malcolm Priestley Committed by Greg Kroah-Hartman
Browse files

staging: vt6656: use off stack for out buffer USB transfers. 



Since 4.9 mandated USB buffers be heap allocated this causes the driver
to fail.

Since there is a wide range of buffer sizes use kmemdup to create
allocated buffer.

Signed-off-by: default avatarMalcolm Priestley <tvboxspy@gmail.com>
Cc: <stable@vger.kernel.org> # v4.9+
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 00916cfc

drivers/staging/vt6656/usbpipe.c

+12 −2
Original line number Original line Diff line number Diff line
@@ -47,15 +47,25 @@ int vnt_control_out(struct vnt_private *priv, u8 request, u16 value, 
		     u16 index, u16 length, u8 *buffer)

		     u16 index, u16 length, u8 *buffer)

{

{

	int status = 0;

	int status = 0;

	u8 *usb_buffer;





	if (test_bit(DEVICE_FLAGS_DISCONNECTED, &priv->flags))

	if (test_bit(DEVICE_FLAGS_DISCONNECTED, &priv->flags))

		return STATUS_FAILURE;

		return STATUS_FAILURE;





	mutex_lock(&priv->usb_lock);

	mutex_lock(&priv->usb_lock);





	usb_buffer = kmemdup(buffer, length, GFP_KERNEL);

	if (!usb_buffer) {

		mutex_unlock(&priv->usb_lock);

		return -ENOMEM;

	}



	status = usb_control_msg(priv->usb,

	status = usb_control_msg(priv->usb,

		usb_sndctrlpipe(priv->usb, 0), request, 0x40, value,

				 usb_sndctrlpipe(priv->usb, 0),

			index, buffer, length, USB_CTL_WAIT);

				 request, 0x40, value,

				 index, usb_buffer, length, USB_CTL_WAIT);



	kfree(usb_buffer);





	mutex_unlock(&priv->usb_lock);

	mutex_unlock(&priv->usb_lock);