korg/linux
0
0
Fork 0
mirror of https://mirrors.bfsu.edu.cn/git/linux.git synced 2024-12-14 06:24:53 +08:00
Code Issues Packages Projects Releases Wiki Activity

orinoco_usb: Fix buffer on stack

Browse Source 
Allocate buffer on HEAP instead of STACK for a local variable
that is to be sent using usb_control_msg().

Signed-off-by: Maksim Salau <maksim.salau@gmail.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
This commit is contained in:
Maksim Salau 2017-04-22 20:03:06 +03:00 committed by Kalle Valo
parent bea35f90db
commit 2f6ae79cb0
1 changed files with 17 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

21
drivers/net/wireless/intersil/orinoco/orinoco_usb.c
View File

@ -769,18 +769,31 @@ static int ezusb_submit_in_urb(struct ezusb_priv *upriv)
static inline int ezusb_8051_cpucs(struct ezusb_priv *upriv, int reset) static inline int ezusb_8051_cpucs(struct ezusb_priv *upriv, int reset)
{ {
u8 res_val = reset; /* avoid argument promotion */ int ret;
u8 *res_val = NULL;
if (!upriv->udev) { if (!upriv->udev) {
err("%s: !upriv->udev", __func__); err("%s: !upriv->udev", __func__);
return -EFAULT; return -EFAULT;
} }
return usb_control_msg(upriv->udev,
res_val = kmalloc(sizeof(*res_val), GFP_KERNEL);
if (!res_val)
return -ENOMEM;
*res_val = reset; /* avoid argument promotion */
ret = usb_control_msg(upriv->udev,
usb_sndctrlpipe(upriv->udev, 0), usb_sndctrlpipe(upriv->udev, 0),
EZUSB_REQUEST_FW_TRANS, EZUSB_REQUEST_FW_TRANS,
USB_TYPE_VENDOR | USB_RECIP_DEVICE | USB_TYPE_VENDOR | USB_RECIP_DEVICE |
USB_DIR_OUT, EZUSB_CPUCS_REG, 0, &res_val, USB_DIR_OUT, EZUSB_CPUCS_REG, 0, res_val,
sizeof(res_val), DEF_TIMEOUT); sizeof(*res_val), DEF_TIMEOUT);
kfree(res_val);
return ret;
} }
static int ezusb_firmware_download(struct ezusb_priv *upriv, static int ezusb_firmware_download(struct ezusb_priv *upriv,