From c6fcf0baa6367fecd3e025253700b64ccff8c1eb Mon Sep 17 00:00:00 2001
From: Bill Pemberton <wfp5p@virginia.edu>
Date: Tue, 27 Apr 2010 16:23:47 -0400
Subject: [PATCH] Staging: hv: don't use dynamic sized array

NetVscOnChannelCallback() used a dynamic sized array that also made
the frame size over 2048.  Replace it with a buffer allocated from
kzalloc.

Signed-off-by: Bill Pemberton <wfp5p@virginia.edu>
Cc: Hank Janssen <hjanssen@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
 drivers/staging/hv/NetVsc.c | 25 ++++++++++++++++---------
 drivers/staging/hv/NetVsc.h |  1 +
 2 files changed, 17 insertions(+), 9 deletions(-)

diff --git a/drivers/staging/hv/NetVsc.c b/drivers/staging/hv/NetVsc.c
index f84942df3bbf..a48e6376ce21 100644
--- a/drivers/staging/hv/NetVsc.c
+++ b/drivers/staging/hv/NetVsc.c
@@ -1288,28 +1288,33 @@ static void NetVscOnReceiveCompletion(void *Context)
 
 void NetVscOnChannelCallback(void *Context)
 {
-	const int netPacketSize = 2048;
 	int ret;
 	struct hv_device *device = Context;
 	struct netvsc_device *netDevice;
 	u32 bytesRecvd;
 	u64 requestId;
-	unsigned char packet[netPacketSize];
+	unsigned char *packet;
 	struct vmpacket_descriptor *desc;
-	unsigned char *buffer = packet;
-	int bufferlen = netPacketSize;
+	unsigned char *buffer;
+	int bufferlen = NETVSC_PACKET_SIZE;
 
 
 	DPRINT_ENTER(NETVSC);
 
 	ASSERT(device);
 
+	packet = kzalloc(NETVSC_PACKET_SIZE * sizeof(unsigned char),
+			 GFP_KERNEL);
+	if (!packet)
+		return;
+	buffer = packet;
+
 	netDevice = GetInboundNetDevice(device);
 	if (!netDevice) {
 		DPRINT_ERR(NETVSC, "net device (%p) shutting down..."
 			   "ignoring inbound packets", netDevice);
 		DPRINT_EXIT(NETVSC);
-		return;
+		goto out;
 	}
 
 	do {
@@ -1341,17 +1346,17 @@ void NetVscOnChannelCallback(void *Context)
 				}
 
 				/* reset */
-				if (bufferlen > netPacketSize) {
+				if (bufferlen > NETVSC_PACKET_SIZE) {
 					kfree(buffer);
 					buffer = packet;
-					bufferlen = netPacketSize;
+					bufferlen = NETVSC_PACKET_SIZE;
 				}
 			} else {
 				/* reset */
-				if (bufferlen > netPacketSize) {
+				if (bufferlen > NETVSC_PACKET_SIZE) {
 					kfree(buffer);
 					buffer = packet;
-					bufferlen = netPacketSize;
+					bufferlen = NETVSC_PACKET_SIZE;
 				}
 
 				break;
@@ -1375,5 +1380,7 @@ void NetVscOnChannelCallback(void *Context)
 
 	PutNetDevice(device);
 	DPRINT_EXIT(NETVSC);
+out:
+	kfree(buffer);
 	return;
 }
diff --git a/drivers/staging/hv/NetVsc.h b/drivers/staging/hv/NetVsc.h
index 6e0e03494126..a6264db8388a 100644
--- a/drivers/staging/hv/NetVsc.h
+++ b/drivers/staging/hv/NetVsc.h
@@ -289,6 +289,7 @@ struct nvsp_message {
 /* Preallocated receive packets */
 #define NETVSC_RECEIVE_PACKETLIST_COUNT		256
 
+#define NETVSC_PACKET_SIZE                      2048
 
 /* Per netvsc channel-specific */
 struct netvsc_device {