From 401711cb575bbbdb100bc1a14cb2024dfc9b4869 Mon Sep 17 00:00:00 2001 From: Johan Hovold Date: Mon, 28 Dec 2009 23:01:57 +0100 Subject: USB: visor: fix DMA buffers on stack Signed-off-by: Johan Hovold Signed-off-by: Greg Kroah-Hartman --- drivers/usb/serial/visor.c | 26 ++++++++++++++++++-------- 1 file changed, 18 insertions(+), 8 deletions(-) (limited to 'drivers') diff --git a/drivers/usb/serial/visor.c b/drivers/usb/serial/visor.c index ad1f9232292..178e4d9abb2 100644 --- a/drivers/usb/serial/visor.c +++ b/drivers/usb/serial/visor.c @@ -807,10 +807,14 @@ static int clie_3_5_startup(struct usb_serial *serial) { struct device *dev = &serial->dev->dev; int result; - u8 data; + u8 *data; dbg("%s", __func__); + data = kmalloc(1, GFP_KERNEL); + if (!data) + return -ENOMEM; + /* * Note that PEG-300 series devices expect the following two calls. */ @@ -818,36 +822,42 @@ static int clie_3_5_startup(struct usb_serial *serial) /* get the config number */ result = usb_control_msg(serial->dev, usb_rcvctrlpipe(serial->dev, 0), USB_REQ_GET_CONFIGURATION, USB_DIR_IN, - 0, 0, &data, 1, 3000); + 0, 0, data, 1, 3000); if (result < 0) { dev_err(dev, "%s: get config number failed: %d\n", __func__, result); - return result; + goto out; } if (result != 1) { dev_err(dev, "%s: get config number bad return length: %d\n", __func__, result); - return -EIO; + result = -EIO; + goto out; } /* get the interface number */ result = usb_control_msg(serial->dev, usb_rcvctrlpipe(serial->dev, 0), USB_REQ_GET_INTERFACE, USB_DIR_IN | USB_RECIP_INTERFACE, - 0, 0, &data, 1, 3000); + 0, 0, data, 1, 3000); if (result < 0) { dev_err(dev, "%s: get interface number failed: %d\n", __func__, result); - return result; + goto out; } if (result != 1) { dev_err(dev, "%s: get interface number bad return length: %d\n", __func__, result); - return -EIO; + result = -EIO; + goto out; } - return generic_startup(serial); + result = generic_startup(serial); +out: + kfree(data); + + return result; } static int treo_attach(struct usb_serial *serial) -- cgit v1.2.3