[PATCH] USB: fix DMA to stack in tt-usb

this driver does DMA to the stack via usb_bulk_msg().

diff --git a/drivers/media/dvb/ttusb-dec/ttusb_dec.c b/drivers/media/dvb/ttusb-dec/ttusb_dec.c
index 7aa1fe2cb326495a0aeaba44c68b0da5b24f0bf7..6122edd673e85386fc2da5a2ef233e1f299d5faa 100644 (file)
--- a/drivers/media/dvb/ttusb-dec/ttusb_dec.c
+++ b/drivers/media/dvb/ttusb-dec/ttusb_dec.c
@@ -204,12 +204,23 @@ static int ttusb_dec_send_command(struct ttusb_dec *dec, const u8 command,
                                  int *result_length, u8 cmd_result[])
 {
        int result, actual_len, i;
-       u8 b[COMMAND_PACKET_SIZE + 4];
-       u8 c[COMMAND_PACKET_SIZE + 4];
+       u8 *b;
+       u8 *c;
+       
+       b = kmalloc(COMMAND_PACKET_SIZE + 4, GFP_KERNEL);
+       if (!b)
+               return -ENOMEM;
+       c = kmalloc(COMMAND_PACKET_SIZE + 4, GFP_KERNEL);
+       if (!c) {
+               kfree(b);
+               return -ENOMEM;
+       }
 
        dprintk("%s\n", __FUNCTION__);
 
        if ((result = down_interruptible(&dec->usb_sem))) {
+               kfree(b);
+               kfree(c);
                printk("%s: Failed to down usb semaphore.\n", __FUNCTION__);
                return result;
        }
@@ -230,22 +241,26 @@ static int ttusb_dec_send_command(struct ttusb_dec *dec, const u8 command,
        }
 
        result = usb_bulk_msg(dec->udev, dec->command_pipe, b,
-                             sizeof(b), &actual_len, HZ);
+                             COMMAND_PACKET_SIZE + 4, &actual_len, HZ);
 
        if (result) {
                printk("%s: command bulk message failed: error %d\n",
                       __FUNCTION__, result);
                up(&dec->usb_sem);
+               kfree(b);
+               kfree(c);
                return result;
        }
 
        result = usb_bulk_msg(dec->udev, dec->result_pipe, c,
-                             sizeof(c), &actual_len, HZ);
+                             COMMAND_PACKET_SIZE + 4, &actual_len, HZ);
 
        if (result) {
                printk("%s: result bulk message failed: error %d\n",
                       __FUNCTION__, result);
                up(&dec->usb_sem);
+               kfree(b);
+               kfree(c);
                return result;
        } else {
                if (debug) {
@@ -262,6 +277,8 @@ static int ttusb_dec_send_command(struct ttusb_dec *dec, const u8 command,
 
                up(&dec->usb_sem);
 
+               kfree(b);
+               kfree(c);
                return 0;
        }
 }