Commit ff179991 authored by Josh Boyer's avatar Josh Boyer Committed by Mauro Carvalho Chehab
Browse files

[media] ttusb2: Don't use stack variables for DMA 

The ttusb2_msg function uses on-stack variables to submit commands to
dvb_usb_generic.  This eventually gets to the DMA api layer and will throw a
traceback if the debugging options are set.

This allocates the temporary buffer variables with kzalloc instead.

Fixes https://bugzilla.redhat.com/show_bug.cgi?id=734506



Signed-off-by: default avatarJosh Boyer <jwboyer@redhat.com>
Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@redhat.com>
parent 2b3c13ec

drivers/media/dvb/dvb-usb/ttusb2.c

+15 −2
Original line number Diff line number Diff line
@@ -75,10 +75,18 @@ static int ttusb2_msg(struct dvb_usb_device *d, u8 cmd, 
		u8 *wbuf, int wlen, u8 *rbuf, int rlen)

{

	struct ttusb2_state *st = d->priv;

	u8 s[wlen+4],r[64] = { 0 };

	u8 *s, *r = NULL;

	int ret = 0;



	memset(s,0,wlen+4);

	s = kzalloc(wlen+4, GFP_KERNEL);

	if (!s)

		return -ENOMEM;



	r = kzalloc(64, GFP_KERNEL);

	if (!r) {

		kfree(s);

		return -ENOMEM;

	}



	s[0] = 0xaa;

	s[1] = ++st->id;
@@ -94,12 +102,17 @@ static int ttusb2_msg(struct dvb_usb_device *d, u8 cmd, 
		r[2] != cmd ||

		(rlen > 0 && r[3] != rlen)) {

		warn("there might have been an error during control message transfer. (rlen = %d, was %d)",rlen,r[3]);

		kfree(s);

		kfree(r);

		return -EIO;

	}



	if (rlen > 0)

		memcpy(rbuf, &r[4], rlen);



	kfree(s);

	kfree(r);



	return 0;

}