Skip to contentSkip to conversation

patch "staging: vt6656: use off stack for in buffer USB transfers." added to staging-next

PATCH [email protected] 1 participant 1 message Apr 29, 2017

Subsystems (2)
lore
Share & tools
lore

[email protected]

author maintainer Applied
#0 lore raw

This is a note to let you know that I've just added the patch titled

staging: vt6656: use off stack for in buffer USB transfers.

to my staging git tree which can be found at
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging.git
in the staging-next branch.

The patch will show up in the next release of the linux-next tree (usually sometime within the next 24 hours during the week.)

The patch will also be merged in the next major kernel release during the merge window.

If you have any questions about this process, please let me know.

Quoted 1 line

From 05c0cf88bec588a7cb34de569acd871ceef26760 Mon Sep 17 00:00:00 2001

From: Malcolm Priestley <[email protected]>
Date: Sat, 22 Apr 2017 11:14:58 +0100
Subject: staging: vt6656: use off stack for in buffer USB transfers.

Since 4.9 mandated USB buffers to be heap allocated. This causes the driver to fail.

Create buffer for USB transfers.

---
 drivers/staging/vt6656/usbpipe.c | 17 +++++++++++++++--
 1 file changed, 15 insertions(+), 2 deletions(-)
drivers/staging/vt6656/usbpipe.c +15 -2
index ea5a7c65ad1b..dc11a05be8c4 100644
@@ -85,15 +85,28 @@ int vnt_control_in(struct vnt_private *priv, u8 request, u16 value,
 		    u16 index, u16 length, u8 *buffer)
 {
 	int status;
+	u8 *usb_buffer;
 
 	if (test_bit(DEVICE_FLAGS_DISCONNECTED, &priv->flags))
 		return STATUS_FAILURE;
 
 	mutex_lock(&priv->usb_lock);
 
+	usb_buffer = kmalloc(length, GFP_KERNEL);
+	if (!usb_buffer) {
+		mutex_unlock(&priv->usb_lock);
+		return -ENOMEM;
+	}
+
 	status = usb_control_msg(priv->usb,
-				usb_rcvctrlpipe(priv->usb, 0), request, 0xc0,
-				value, index, buffer, length, USB_CTL_WAIT);
+				 usb_rcvctrlpipe(priv->usb, 0),
+				 request, 0xc0, value,
+				 index, usb_buffer, length, USB_CTL_WAIT);
+
+	if (status == length)
+		memcpy(buffer, usb_buffer, length);
+
+	kfree(usb_buffer);
 
 	mutex_unlock(&priv->usb_lock);
 
Signature · 1 line
2.12.2