Skip to contentSkip to conversation

Patch "net: can: usb: gs_usb: Fix buffer on stack" has been added to the 4.9-stable tree

PATCH [email protected] 1 participant 1 message Apr 30, 2017

Subsystems (2)
Stable branch CAN network drivers
lore
Share & tools
lore

[email protected]

author maintainer Applied
#0 lore raw

This is a note to let you know that I've just added the patch titled

net: can: usb: gs_usb: Fix buffer on stack

to the 4.9-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
net-can-usb-gs_usb-fix-buffer-on-stack.patch
and it can be found in the queue-4.9 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

Quoted 1 line

From b05c73bd1e3ec60357580eb042ee932a5ed754d5 Mon Sep 17 00:00:00 2001

From: Maksim Salau <[email protected]>
Date: Sun, 23 Apr 2017 20:31:40 +0300
Subject: net: can: usb: gs_usb: Fix buffer on stack

From: Maksim Salau <[email protected]>

commit b05c73bd1e3ec60357580eb042ee932a5ed754d5 upstream.

Allocate buffers on HEAP instead of STACK for local structures that are to be sent using usb_control_msg().

Signed-off-by Maksim Salau <[email protected]>
Signed-off-by Marc Kleine-Budde <[email protected]>
Signed-off-by Greg Kroah-Hartman <[email protected]>
---
 drivers/net/can/usb/gs_usb.c |   17 ++++++++++++-----
 1 file changed, 12 insertions(+), 5 deletions(-)
drivers/net/can/usb/gs_usb.c +12 -5
@@ -740,13 +740,18 @@ static const struct net_device_ops gs_us
 static int gs_usb_set_identify(struct net_device *netdev, bool do_identify)
 {
 	struct gs_can *dev = netdev_priv(netdev);
-	struct gs_identify_mode imode;
+	struct gs_identify_mode *imode;
 	int rc;
 
+	imode = kmalloc(sizeof(*imode), GFP_KERNEL);
+
+	if (!imode)
+		return -ENOMEM;
+
 	if (do_identify)
-		imode.mode = GS_CAN_IDENTIFY_ON;
+		imode->mode = GS_CAN_IDENTIFY_ON;
 	else
-		imode.mode = GS_CAN_IDENTIFY_OFF;
+		imode->mode = GS_CAN_IDENTIFY_OFF;
 
 	rc = usb_control_msg(interface_to_usbdev(dev->iface),
 			     usb_sndctrlpipe(interface_to_usbdev(dev->iface),

@@ -756,10 +761,12 @@ static int gs_usb_set_identify(struct ne
 			     USB_RECIP_INTERFACE,
 			     dev->channel,
 			     0,
-			     &imode,
-			     sizeof(imode),
+			     imode,
+			     sizeof(*imode),
 			     100);
 
+	kfree(imode);
+
 	return (rc > 0) ? 0 : rc;
 }

Patches currently in stable-queue which might be from [email protected] are

queue-4.9/net-can-usb-gs_usb-fix-buffer-on-stack.patch