From d846b7650db3fcca7901b6e23f6416c3601a3dfe Mon Sep 17 00:00:00 2001 From: Oliver Neukum Date: Mon, 19 May 2014 13:54:57 +0200 Subject: [PATCH] USB: usbtmc: fix DMA on stack send_request_dev_dep_msg_in() use a buffer allocated on the stack. Fix by kmalloc()ing the buffer. Signed-off-by: Oliver Neukum Signed-off-by: Greg Kroah-Hartman --- drivers/usb/class/usbtmc.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/drivers/usb/class/usbtmc.c b/drivers/usb/class/usbtmc.c index cfbec9c7e09e..103a6e9ee49d 100644 --- a/drivers/usb/class/usbtmc.c +++ b/drivers/usb/class/usbtmc.c @@ -383,9 +383,12 @@ exit: static int send_request_dev_dep_msg_in(struct usbtmc_device_data *data, size_t transfer_size) { int retval; - u8 buffer[USBTMC_HEADER_SIZE]; + u8 *buffer; int actual; + buffer = kmalloc(USBTMC_HEADER_SIZE, GFP_KERNEL); + if (!buffer) + return -ENOMEM; /* Setup IO buffer for REQUEST_DEV_DEP_MSG_IN message * Refer to class specs for details */ @@ -417,6 +420,7 @@ static int send_request_dev_dep_msg_in(struct usbtmc_device_data *data, size_t t if (!data->bTag) data->bTag++; + kfree(buffer); if (retval < 0) { dev_err(&data->intf->dev, "usb_bulk_msg in send_request_dev_dep_msg_in() returned %d\n", retval); return retval; -- 2.11.0