releases/4.11.2/staging-vt6656-use-off-stack-for-in-buffer-usb-transfers.patch

   1 From 05c0cf88bec588a7cb34de569acd871ceef26760 Mon Sep 17 00:00:00 2001
   2 From: Malcolm Priestley <tvboxspy@gmail.com>
   3 Date: Sat, 22 Apr 2017 11:14:58 +0100
   4 Subject: staging: vt6656: use off stack for in buffer USB transfers.
   5
   6 From: Malcolm Priestley <tvboxspy@gmail.com>
   7
   8 commit 05c0cf88bec588a7cb34de569acd871ceef26760 upstream.
   9
  10 Since 4.9 mandated USB buffers to be heap allocated. This causes
  11 the driver to fail.
  12
  13 Create buffer for USB transfers.
  14
  15 Signed-off-by: Malcolm Priestley <tvboxspy@gmail.com>
  16 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  17
  18 ---
  19  drivers/staging/vt6656/usbpipe.c |   17 +++++++++++++++--
  20  1 file changed, 15 insertions(+), 2 deletions(-)
  21
  22 --- a/drivers/staging/vt6656/usbpipe.c
  23 +++ b/drivers/staging/vt6656/usbpipe.c
  24 @@ -75,15 +75,28 @@ int vnt_control_in(struct vnt_private *p
  25                     u16 index, u16 length, u8 *buffer)
  26  {
  27         int status;
  28 +       u8 *usb_buffer;
  29
  30         if (test_bit(DEVICE_FLAGS_DISCONNECTED, &priv->flags))
  31                 return STATUS_FAILURE;
  32
  33         mutex_lock(&priv->usb_lock);
  34
  35 +       usb_buffer = kmalloc(length, GFP_KERNEL);
  36 +       if (!usb_buffer) {
  37 +               mutex_unlock(&priv->usb_lock);
  38 +               return -ENOMEM;
  39 +       }
  40 +
  41         status = usb_control_msg(priv->usb,
  42 -                               usb_rcvctrlpipe(priv->usb, 0), request, 0xc0, value,
  43 -                               index, buffer, length, USB_CTL_WAIT);
  44 +                                usb_rcvctrlpipe(priv->usb, 0),
  45 +                                request, 0xc0, value,
  46 +                                index, usb_buffer, length, USB_CTL_WAIT);
  47 +
  48 +       if (status == length)
  49 +               memcpy(buffer, usb_buffer, length);
  50 +
  51 +       kfree(usb_buffer);
  52
  53         mutex_unlock(&priv->usb_lock);
  54