diff options
| -rw-r--r-- | drivers/usb/misc/usbtest.c | 10 |
1 files changed, 9 insertions, 1 deletions
diff --git a/drivers/usb/misc/usbtest.c b/drivers/usb/misc/usbtest.c index 8b220d56647b..150090ee4ec1 100644 --- a/drivers/usb/misc/usbtest.c +++ b/drivers/usb/misc/usbtest.c @@ -2043,7 +2043,7 @@ test_queue(struct usbtest_dev *dev, struct usbtest_param_32 *param, unsigned i; unsigned long packets = 0; int status = 0; - struct urb *urbs[MAX_SGLEN]; + struct urb **urbs; if (!param->sglen || param->iterations > UINT_MAX / param->sglen) return -EINVAL; @@ -2051,6 +2051,10 @@ test_queue(struct usbtest_dev *dev, struct usbtest_param_32 *param, if (param->sglen > MAX_SGLEN) return -EINVAL; + urbs = kcalloc(param->sglen, sizeof(*urbs), GFP_KERNEL); + if (!urbs) + return -ENOMEM; + memset(&context, 0, sizeof(context)); context.count = param->iterations * param->sglen; context.dev = dev; @@ -2137,6 +2141,8 @@ test_queue(struct usbtest_dev *dev, struct usbtest_param_32 *param, else if (context.errors > (context.is_iso ? context.packet_count / 10 : 0)) status = -EIO; + + kfree(urbs); return status; fail: @@ -2144,6 +2150,8 @@ fail: if (urbs[i]) simple_free_urb(urbs[i]); } + + kfree(urbs); return status; } |