Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux

video: fbdev: udlfb: Fix buffer on stack

Allocate buffers on HEAP instead of STACK for local array
that is to be sent using usb_control_msg().

Signed-off-by: Maksim Salau <maksim.salau@gmail.com>
Cc: Bernie Thompson <bernie@plugable.com>
Cc: Geert Uytterhoeven <geert@linux-m68k.org>
Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>

authored by

Maksim Salau and committed by
Bartlomiej Zolnierkiewicz
45f580c4 3bbb5b82

+12 -2
+12 -2
drivers/video/fbdev/udlfb.c
··· 1487 1487 static int dlfb_select_std_channel(struct dlfb_data *dev) 1488 1488 { 1489 1489 int ret; 1490 - u8 set_def_chn[] = { 0x57, 0xCD, 0xDC, 0xA7, 1490 + void *buf; 1491 + static const u8 set_def_chn[] = { 1492 + 0x57, 0xCD, 0xDC, 0xA7, 1491 1493 0x1C, 0x88, 0x5E, 0x15, 1492 1494 0x60, 0xFE, 0xC6, 0x97, 1493 1495 0x16, 0x3D, 0x47, 0xF2 }; 1494 1496 1497 + buf = kmemdup(set_def_chn, sizeof(set_def_chn), GFP_KERNEL); 1498 + 1499 + if (!buf) 1500 + return -ENOMEM; 1501 + 1495 1502 ret = usb_control_msg(dev->udev, usb_sndctrlpipe(dev->udev, 0), 1496 1503 NR_USB_REQUEST_CHANNEL, 1497 1504 (USB_DIR_OUT | USB_TYPE_VENDOR), 0, 0, 1498 - set_def_chn, sizeof(set_def_chn), USB_CTRL_SET_TIMEOUT); 1505 + buf, sizeof(set_def_chn), USB_CTRL_SET_TIMEOUT); 1506 + 1507 + kfree(buf); 1508 + 1499 1509 return ret; 1500 1510 } 1501 1511