Skip to contentSkip to conversation

staging: comedi: usbdux: allocating too much data

PATCH In review Dan Carpenter 2 participants 2 messages Aug 20, 2013

Subsystems (2)
Staging Kernel janitors
lore
Share & tools
lore

Dan Carpenter

author
#0 lore raw

PATCH 1/1 staging: comedi: usbdux: allocating too much data

We only need to allocate enough space for a pointer. We allocate the space for the urbs themselves with the call to usb_alloc_urb() a few lines later.

Signed-off-by Dan Carpenter <[email protected]>

---
Untested.

drivers/staging/comedi/drivers/usbdux.c +2 -2
index 7e91f15..701ad1a 100644
@@ -1558,9 +1558,9 @@ static int usbdux_alloc_usb_buffers(struct comedi_device *dev)
 	devpriv->dux_commands = kzalloc(SIZEOFDUXBUFFER, GFP_KERNEL);
 	devpriv->in_buf = kzalloc(SIZEINBUF, GFP_KERNEL);
 	devpriv->insn_buf = kzalloc(SIZEINSNBUF, GFP_KERNEL);
-	devpriv->ai_urbs = kcalloc(devpriv->n_ai_urbs, sizeof(*urb),
+	devpriv->ai_urbs = kcalloc(devpriv->n_ai_urbs, sizeof(void *),
 				   GFP_KERNEL);
-	devpriv->ao_urbs = kcalloc(devpriv->n_ao_urbs, sizeof(*urb),
+	devpriv->ao_urbs = kcalloc(devpriv->n_ao_urbs, sizeof(void *),
 				   GFP_KERNEL);
 	if (!devpriv->dux_commands || !devpriv->in_buf || !devpriv->insn_buf ||
 	    !devpriv->ai_urbs || !devpriv->ao_urbs)
Acked-by on v1 1/1
#1 lore raw
Quoted 15 lines · Dan Carpenter

We only need to allocate enough space for a pointer. We allocate the space for the urbs themselves with the call to usb_alloc_urb() a few lines later.

Signed-off-by Dan Carpenter <[email protected]>

---
Untested.

drivers/staging/comedi/drivers/usbdux.c +0 -0
index 7e91f15..701ad1a 100644
@@ -1558,9 +1558,9 @@ static int usbdux_alloc_usb_buffers(struct comedi_device *dev)
  	devpriv->dux_commands = kzalloc(SIZEOFDUXBUFFER, GFP_KERNEL);

drivers/staging/comedi/drivers/usbdux.c static int usbdux_alloc_usb_buffers(struct comedi_device *dev) · line 1566

Quoted 10 lines
drivers/staging/comedi/drivers/usbdux.c +2 -2
  	devpriv->in_buf = kzalloc(SIZEINBUF, GFP_KERNEL);
  	devpriv->insn_buf = kzalloc(SIZEINSNBUF, GFP_KERNEL);
-	devpriv->ai_urbs = kcalloc(devpriv->n_ai_urbs, sizeof(*urb),
+	devpriv->ai_urbs = kcalloc(devpriv->n_ai_urbs, sizeof(void *),
  				   GFP_KERNEL);
-	devpriv->ao_urbs = kcalloc(devpriv->n_ao_urbs, sizeof(*urb),
+	devpriv->ao_urbs = kcalloc(devpriv->n_ao_urbs, sizeof(void *),
  				   GFP_KERNEL);
  	if (!devpriv->dux_commands || !devpriv->in_buf || !devpriv->insn_buf ||
  	    !devpriv->ai_urbs || !devpriv->ao_urbs)
Acked-by Ian Abbott <[email protected]>

Also, usbduxsigma.c has the same problem.

Signature · 2 lines
-=( Ian Abbott @ MEV Ltd.    E-mail: <[email protected]>        )=-
-=( Tel: +44 (0)161 477 1898   FAX: +44 (0)161 718 3587         )=-