diff options
| author | Josh Boyer <jwboyer@redhat.com> | 2011-11-02 23:39:58 +0400 |
|---|---|---|
| committer | Ben Hutchings <ben@decadent.org.uk> | 2017-08-26 04:14:01 +0300 |
| commit | 489c80155c8691d282ce18f62a3a83b0adf9ee0e (patch) | |
| tree | df56f873a4dfae33d1517eb3531950da7cdc4e55 | |
| parent | e8fba6090bb5bc277c017f8ca0f39cf303616682 (diff) | |
| download | linux-489c80155c8691d282ce18f62a3a83b0adf9ee0e.tar.xz | |
ttusb2: Don't use stack variables for DMA
commit ff17999184ed13829bc14c3be412d980173dff40 upstream.
The ttusb2_msg function uses on-stack variables to submit commands to
dvb_usb_generic. This eventually gets to the DMA api layer and will throw a
traceback if the debugging options are set.
This allocates the temporary buffer variables with kzalloc instead.
Fixes https://bugzilla.redhat.com/show_bug.cgi?id=734506
Signed-off-by: Josh Boyer <jwboyer@redhat.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
| -rw-r--r-- | drivers/media/dvb/dvb-usb/ttusb2.c | 17 |
1 files changed, 15 insertions, 2 deletions
diff --git a/drivers/media/dvb/dvb-usb/ttusb2.c b/drivers/media/dvb/dvb-usb/ttusb2.c index ea4eab8b3965..faed393c08b6 100644 --- a/drivers/media/dvb/dvb-usb/ttusb2.c +++ b/drivers/media/dvb/dvb-usb/ttusb2.c @@ -75,10 +75,18 @@ static int ttusb2_msg(struct dvb_usb_device *d, u8 cmd, u8 *wbuf, int wlen, u8 *rbuf, int rlen) { struct ttusb2_state *st = d->priv; - u8 s[wlen+4],r[64] = { 0 }; + u8 *s, *r = NULL; int ret = 0; - memset(s,0,wlen+4); + s = kzalloc(wlen+4, GFP_KERNEL); + if (!s) + return -ENOMEM; + + r = kzalloc(64, GFP_KERNEL); + if (!r) { + kfree(s); + return -ENOMEM; + } s[0] = 0xaa; s[1] = ++st->id; @@ -94,12 +102,17 @@ static int ttusb2_msg(struct dvb_usb_device *d, u8 cmd, r[2] != cmd || (rlen > 0 && r[3] != rlen)) { warn("there might have been an error during control message transfer. (rlen = %d, was %d)",rlen,r[3]); + kfree(s); + kfree(r); return -EIO; } if (rlen > 0) memcpy(rbuf, &r[4], rlen); + kfree(s); + kfree(r); + return 0; } |