diff options
| author | Oliver Neukum <oneukum@suse.de> | 2014-05-19 15:54:57 +0400 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2014-05-28 03:03:57 +0400 |
| commit | d846b7650db3fcca7901b6e23f6416c3601a3dfe (patch) | |
| tree | 750ca1f6bd5b2b287a9123f7208589d4f9264b67 /drivers/usb/class | |
| parent | d1b781002b31247d38a2892c51b88348d6a8f201 (diff) | |
| download | linux-d846b7650db3fcca7901b6e23f6416c3601a3dfe.tar.xz | |
USB: usbtmc: fix DMA on stack
send_request_dev_dep_msg_in() use a buffer allocated on the stack.
Fix by kmalloc()ing the buffer.
Signed-off-by: Oliver Neukum <oneukum@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers/usb/class')
| -rw-r--r-- | drivers/usb/class/usbtmc.c | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/drivers/usb/class/usbtmc.c b/drivers/usb/class/usbtmc.c index cfbec9c7e09e..103a6e9ee49d 100644 --- a/drivers/usb/class/usbtmc.c +++ b/drivers/usb/class/usbtmc.c @@ -383,9 +383,12 @@ exit: static int send_request_dev_dep_msg_in(struct usbtmc_device_data *data, size_t transfer_size) { int retval; - u8 buffer[USBTMC_HEADER_SIZE]; + u8 *buffer; int actual; + buffer = kmalloc(USBTMC_HEADER_SIZE, GFP_KERNEL); + if (!buffer) + return -ENOMEM; /* Setup IO buffer for REQUEST_DEV_DEP_MSG_IN message * Refer to class specs for details */ @@ -417,6 +420,7 @@ static int send_request_dev_dep_msg_in(struct usbtmc_device_data *data, size_t t if (!data->bTag) data->bTag++; + kfree(buffer); if (retval < 0) { dev_err(&data->intf->dev, "usb_bulk_msg in send_request_dev_dep_msg_in() returned %d\n", retval); return retval; |