]>
Commit | Line | Data |
---|---|---|
4bc507ef GKH |
1 | From 065e60964e293227e4feb0c1f7e27e609316ed9a Mon Sep 17 00:00:00 2001 |
2 | From: Adam Cozzette <acozzette@cs.hmc.edu> | |
3 | Date: Wed, 24 Aug 2011 12:22:37 -0600 | |
4 | Subject: ums_realtek: do not use stack memory for DMA | |
5 | ||
6 | From: Adam Cozzette <acozzette@cs.hmc.edu> | |
7 | ||
8 | commit 065e60964e293227e4feb0c1f7e27e609316ed9a upstream. | |
9 | ||
10 | This patch changes rts51x_read_mem, rts51x_write_mem, and rts51x_read_status to | |
11 | allocate temporary buffers with kmalloc. This way stack addresses are not used | |
12 | for DMA when these functions call rts51x_bulk_transport. | |
13 | ||
14 | Signed-off-by: Adam Cozzette <acozzette@cs.hmc.edu> | |
15 | Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> | |
16 | ||
17 | --- | |
18 | drivers/usb/storage/realtek_cr.c | 35 ++++++++++++++++++++++++++++++----- | |
19 | 1 file changed, 30 insertions(+), 5 deletions(-) | |
20 | ||
21 | --- a/drivers/usb/storage/realtek_cr.c | |
22 | +++ b/drivers/usb/storage/realtek_cr.c | |
23 | @@ -320,6 +320,11 @@ static int rts51x_read_mem(struct us_dat | |
24 | { | |
25 | int retval; | |
26 | u8 cmnd[12] = { 0 }; | |
27 | + u8 *buf; | |
28 | + | |
29 | + buf = kmalloc(len, GFP_NOIO); | |
30 | + if (buf == NULL) | |
31 | + return USB_STOR_TRANSPORT_ERROR; | |
32 | ||
33 | US_DEBUGP("%s, addr = 0x%x, len = %d\n", __func__, addr, len); | |
34 | ||
35 | @@ -331,10 +336,14 @@ static int rts51x_read_mem(struct us_dat | |
36 | cmnd[5] = (u8) len; | |
37 | ||
38 | retval = rts51x_bulk_transport(us, 0, cmnd, 12, | |
39 | - data, len, DMA_FROM_DEVICE, NULL); | |
40 | - if (retval != USB_STOR_TRANSPORT_GOOD) | |
41 | + buf, len, DMA_FROM_DEVICE, NULL); | |
42 | + if (retval != USB_STOR_TRANSPORT_GOOD) { | |
43 | + kfree(buf); | |
44 | return -EIO; | |
45 | + } | |
46 | ||
47 | + memcpy(data, buf, len); | |
48 | + kfree(buf); | |
49 | return 0; | |
50 | } | |
51 | ||
52 | @@ -342,6 +351,12 @@ static int rts51x_write_mem(struct us_da | |
53 | { | |
54 | int retval; | |
55 | u8 cmnd[12] = { 0 }; | |
56 | + u8 *buf; | |
57 | + | |
58 | + buf = kmalloc(len, GFP_NOIO); | |
59 | + if (buf == NULL) | |
60 | + return USB_STOR_TRANSPORT_ERROR; | |
61 | + memcpy(buf, data, len); | |
62 | ||
63 | US_DEBUGP("%s, addr = 0x%x, len = %d\n", __func__, addr, len); | |
64 | ||
65 | @@ -353,7 +368,8 @@ static int rts51x_write_mem(struct us_da | |
66 | cmnd[5] = (u8) len; | |
67 | ||
68 | retval = rts51x_bulk_transport(us, 0, cmnd, 12, | |
69 | - data, len, DMA_TO_DEVICE, NULL); | |
70 | + buf, len, DMA_TO_DEVICE, NULL); | |
71 | + kfree(buf); | |
72 | if (retval != USB_STOR_TRANSPORT_GOOD) | |
73 | return -EIO; | |
74 | ||
75 | @@ -365,6 +381,11 @@ static int rts51x_read_status(struct us_ | |
76 | { | |
77 | int retval; | |
78 | u8 cmnd[12] = { 0 }; | |
79 | + u8 *buf; | |
80 | + | |
81 | + buf = kmalloc(len, GFP_NOIO); | |
82 | + if (buf == NULL) | |
83 | + return USB_STOR_TRANSPORT_ERROR; | |
84 | ||
85 | US_DEBUGP("%s, lun = %d\n", __func__, lun); | |
86 | ||
87 | @@ -372,10 +393,14 @@ static int rts51x_read_status(struct us_ | |
88 | cmnd[1] = 0x09; | |
89 | ||
90 | retval = rts51x_bulk_transport(us, lun, cmnd, 12, | |
91 | - status, len, DMA_FROM_DEVICE, actlen); | |
92 | - if (retval != USB_STOR_TRANSPORT_GOOD) | |
93 | + buf, len, DMA_FROM_DEVICE, actlen); | |
94 | + if (retval != USB_STOR_TRANSPORT_GOOD) { | |
95 | + kfree(buf); | |
96 | return -EIO; | |
97 | + } | |
98 | ||
99 | + memcpy(status, buf, len); | |
100 | + kfree(buf); | |
101 | return 0; | |
102 | } | |
103 |