From: Peter Korsgaard <jacmet@sunsite•dk>
To: Oliver Neukum <oliver@neukum•org>, jeff@garzik•org
Cc: netdev@vger•kernel.org, linux-usb@vger•kernel.org
Subject: Re: [PATCH RESEND] dm9601: don't do usb transfers of data on stack
Date: Fri, 11 Jul 2008 14:57:39 +0200 [thread overview]
Message-ID: <87mykoefy4.fsf@macbook.be.48ers.dk> (raw)
In-Reply-To: <200807111422.56406.oliver@neukum.org> (Oliver Neukum's message of "Fri\, 11 Jul 2008 14\:22\:55 +0200")
dm_{read,write}() were doing USB transfers of data on stack, which isn't
allowed. Fix it by kmalloc'ing a temporary buffer.
Clean up the error handling for short transfers while we're at it.
Signed-off-by: Peter Korsgaard <jacmet@sunsite•dk>
---
drivers/net/usb/dm9601.c | 52 +++++++++++++++++++++++++++++++++++++--------
1 files changed, 42 insertions(+), 10 deletions(-)
diff --git a/drivers/net/usb/dm9601.c b/drivers/net/usb/dm9601.c
index f7319d3..78df2be 100644
--- a/drivers/net/usb/dm9601.c
+++ b/drivers/net/usb/dm9601.c
@@ -55,12 +55,28 @@
static int dm_read(struct usbnet *dev, u8 reg, u16 length, void *data)
{
+ void *buf;
+ int err = -ENOMEM;
+
devdbg(dev, "dm_read() reg=0x%02x length=%d", reg, length);
- return usb_control_msg(dev->udev,
- usb_rcvctrlpipe(dev->udev, 0),
- DM_READ_REGS,
- USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
- 0, reg, data, length, USB_CTRL_SET_TIMEOUT);
+
+ buf = kmalloc(length, GFP_KERNEL);
+ if (!buf)
+ goto out;
+
+ err = usb_control_msg(dev->udev,
+ usb_rcvctrlpipe(dev->udev, 0),
+ DM_READ_REGS,
+ USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
+ 0, reg, buf, length, USB_CTRL_SET_TIMEOUT);
+ if (err == length)
+ memcpy(data, buf, length);
+ else if (err >= 0)
+ err = -EINVAL;
+ kfree(buf);
+
+ out:
+ return err;
}
static int dm_read_reg(struct usbnet *dev, u8 reg, u8 *value)
@@ -70,12 +86,28 @@ static int dm_read_reg(struct usbnet *dev, u8 reg, u8 *value)
static int dm_write(struct usbnet *dev, u8 reg, u16 length, void *data)
{
+ void *buf = NULL;
+ int err = -ENOMEM;
+
devdbg(dev, "dm_write() reg=0x%02x, length=%d", reg, length);
- return usb_control_msg(dev->udev,
- usb_sndctrlpipe(dev->udev, 0),
- DM_WRITE_REGS,
- USB_DIR_OUT | USB_TYPE_VENDOR |USB_RECIP_DEVICE,
- 0, reg, data, length, USB_CTRL_SET_TIMEOUT);
+
+ if (data) {
+ buf = kmalloc(length, GFP_KERNEL);
+ if (!buf)
+ goto out;
+ memcpy(buf, data, length);
+ }
+
+ err = usb_control_msg(dev->udev,
+ usb_sndctrlpipe(dev->udev, 0),
+ DM_WRITE_REGS,
+ USB_DIR_OUT | USB_TYPE_VENDOR |USB_RECIP_DEVICE,
+ 0, reg, buf, length, USB_CTRL_SET_TIMEOUT);
+ kfree(buf);
+ if (err >= 0 && err < length)
+ err = -EINVAL;
+ out:
+ return err;
}
static int dm_write_reg(struct usbnet *dev, u8 reg, u8 value)
--
1.5.6.2
--
Bye, Peter Korsgaard
next prev parent reply other threads:[~2008-07-11 12:57 UTC|newest]
Thread overview: 9+ messages / expand[flat|nested] mbox.gz Atom feed top
2008-07-11 11:37 [PATCH RESEND] dm9601: don't do usb transfers of data on stack Peter Korsgaard
[not found] ` <87mykoircs.fsf-uXGAPMMVk8amE9MCos8gUmSdvHPH+/yF@public.gmane.org>
2008-07-11 12:00 ` Oliver Neukum
[not found] ` <200807111400.38312.oliver-GvhC2dPhHPQdnm+yROfE0A@public.gmane.org>
2008-07-11 12:17 ` Peter Korsgaard
2008-07-11 12:22 ` Oliver Neukum
[not found] ` <200807111422.56406.oliver-GvhC2dPhHPQdnm+yROfE0A@public.gmane.org>
2008-07-11 12:55 ` Peter Korsgaard
2008-07-11 12:57 ` Peter Korsgaard [this message]
[not found] ` <87mykoefy4.fsf-uXGAPMMVk8amE9MCos8gUmSdvHPH+/yF@public.gmane.org>
2008-07-11 22:02 ` David Brownell
[not found] ` <200807111502.20507.david-b-yBeKhBN/0LDR7s880joybQ@public.gmane.org>
2008-07-14 7:07 ` Peter Korsgaard
[not found] ` <87wsjp9c5n.fsf-uXGAPMMVk8amE9MCos8gUmSdvHPH+/yF@public.gmane.org>
2008-07-30 8:48 ` Jeff Garzik
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=87mykoefy4.fsf@macbook.be.48ers.dk \
--to=jacmet@sunsite$(echo .)dk \
--cc=jeff@garzik$(echo .)org \
--cc=linux-usb@vger$(echo .)kernel.org \
--cc=netdev@vger$(echo .)kernel.org \
--cc=oliver@neukum$(echo .)org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox