From 8c9e7aa10a1cd240d5f8f89e959e242ea0bc0744 Mon Sep 17 00:00:00 2001 From: Oliver Neukum Date: Thu, 22 Jan 2004 23:56:38 -0800 Subject: [PATCH] [PATCH] USB: fix dma to stack in ti driver you cannot use usb_bulk_msg() on buffers on the stack. --- drivers/usb/misc/tiglusb.c | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) diff --git a/drivers/usb/misc/tiglusb.c b/drivers/usb/misc/tiglusb.c index 5ee81f7d95774..2ebf65f4130fb 100644 --- a/drivers/usb/misc/tiglusb.c +++ b/drivers/usb/misc/tiglusb.c @@ -161,7 +161,7 @@ tiglusb_read (struct file *filp, char __user *buf, size_t count, loff_t * f_pos) int bytes_to_read = 0; int bytes_read = 0; int result = 0; - char buffer[BULK_RCV_MAX]; + char *buffer; unsigned int pipe; if (*f_pos) @@ -173,6 +173,10 @@ tiglusb_read (struct file *filp, char __user *buf, size_t count, loff_t * f_pos) if (!s->dev) return -EIO; + buffer = kmalloc(BULK_RCV_MAX, GFP_KERNEL); + if (!buffer) + return -ENOMEM; + bytes_to_read = (count >= BULK_RCV_MAX) ? BULK_RCV_MAX : count; pipe = usb_rcvbulkpipe (s->dev, 1); @@ -203,6 +207,7 @@ tiglusb_read (struct file *filp, char __user *buf, size_t count, loff_t * f_pos) } out: + kfree(buffer); return ret ? ret : bytes_read; } @@ -214,7 +219,7 @@ tiglusb_write (struct file *filp, const char __user *buf, size_t count, loff_t * int bytes_to_write = 0; int bytes_written = 0; int result = 0; - char buffer[BULK_SND_MAX]; + char *buffer; unsigned int pipe; if (*f_pos) @@ -226,6 +231,10 @@ tiglusb_write (struct file *filp, const char __user *buf, size_t count, loff_t * if (!s->dev) return -EIO; + buffer = kmalloc(BULK_SND_MAX, GFP_KERNEL); + if (!buffer) + return -ENOMEM; + bytes_to_write = (count >= BULK_SND_MAX) ? BULK_SND_MAX : count; if (copy_from_user (buffer, buf, bytes_to_write)) { ret = -EFAULT; @@ -258,6 +267,7 @@ tiglusb_write (struct file *filp, const char __user *buf, size_t count, loff_t * } out: + kfree(buffer); return ret ? ret : bytes_written; } -- 2.53.0