summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorOliver Neukum <oneukum@suse.de>2014-05-19 13:54:57 +0200
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>2014-05-27 16:03:57 -0700
commitd846b7650db3fcca7901b6e23f6416c3601a3dfe (patch)
tree750ca1f6bd5b2b287a9123f7208589d4f9264b67
parentd1b781002b31247d38a2892c51b88348d6a8f201 (diff)
USB: usbtmc: fix DMA on stack
send_request_dev_dep_msg_in() use a buffer allocated on the stack. Fix by kmalloc()ing the buffer. Signed-off-by: Oliver Neukum <oneukum@suse.de> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-rw-r--r--drivers/usb/class/usbtmc.c6
1 files changed, 5 insertions, 1 deletions
diff --git a/drivers/usb/class/usbtmc.c b/drivers/usb/class/usbtmc.c
index cfbec9c7e09e..103a6e9ee49d 100644
--- a/drivers/usb/class/usbtmc.c
+++ b/drivers/usb/class/usbtmc.c
@@ -383,9 +383,12 @@ exit:
static int send_request_dev_dep_msg_in(struct usbtmc_device_data *data, size_t transfer_size)
{
int retval;
- u8 buffer[USBTMC_HEADER_SIZE];
+ u8 *buffer;
int actual;
+ buffer = kmalloc(USBTMC_HEADER_SIZE, GFP_KERNEL);
+ if (!buffer)
+ return -ENOMEM;
/* Setup IO buffer for REQUEST_DEV_DEP_MSG_IN message
* Refer to class specs for details
*/
@@ -417,6 +420,7 @@ static int send_request_dev_dep_msg_in(struct usbtmc_device_data *data, size_t t
if (!data->bTag)
data->bTag++;
+ kfree(buffer);
if (retval < 0) {
dev_err(&data->intf->dev, "usb_bulk_msg in send_request_dev_dep_msg_in() returned %d\n", retval);
return retval;