From: Oliver Neukum <oneukum@suse.de>
Date: Mon, 19 May 2014 11:54:57 +0000 (+0200)
Subject: USB: usbtmc: fix DMA on stack
X-Git-Tag: next-20140530~20^2~46
X-Git-Url: https://git.karo-electronics.de/?a=commitdiff_plain;h=d846b7650db3fcca7901b6e23f6416c3601a3dfe;p=karo-tx-linux.git

USB: usbtmc: fix DMA on stack

send_request_dev_dep_msg_in() use a buffer allocated on the stack.
Fix by kmalloc()ing the buffer.

Signed-off-by: Oliver Neukum <oneukum@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---

diff --git a/drivers/usb/class/usbtmc.c b/drivers/usb/class/usbtmc.c
index cfbec9c7e09e..103a6e9ee49d 100644
--- a/drivers/usb/class/usbtmc.c
+++ b/drivers/usb/class/usbtmc.c
@@ -383,9 +383,12 @@ exit:
 static int send_request_dev_dep_msg_in(struct usbtmc_device_data *data, size_t transfer_size)
 {
 	int retval;
-	u8 buffer[USBTMC_HEADER_SIZE];
+	u8 *buffer;
 	int actual;
 
+	buffer = kmalloc(USBTMC_HEADER_SIZE, GFP_KERNEL);
+	if (!buffer)
+		return -ENOMEM;
 	/* Setup IO buffer for REQUEST_DEV_DEP_MSG_IN message
 	 * Refer to class specs for details
 	 */
@@ -417,6 +420,7 @@ static int send_request_dev_dep_msg_in(struct usbtmc_device_data *data, size_t t
 	if (!data->bTag)
 		data->bTag++;
 
+	kfree(buffer);
 	if (retval < 0) {
 		dev_err(&data->intf->dev, "usb_bulk_msg in send_request_dev_dep_msg_in() returned %d\n", retval);
 		return retval;