提交 b05c73bd 编写于 作者: M Maksim Salau 提交者: Marc Kleine-Budde

net: can: usb: gs_usb: Fix buffer on stack

Allocate buffers on HEAP instead of STACK for local structures
that are to be sent using usb_control_msg().
Signed-off-by: NMaksim Salau <maksim.salau@gmail.com>
Cc: linux-stable <stable@vger.kernel.org> # >= v4.8
Signed-off-by: NMarc Kleine-Budde <mkl@pengutronix.de>
上级 71b61156
...@@ -739,13 +739,18 @@ static const struct net_device_ops gs_usb_netdev_ops = { ...@@ -739,13 +739,18 @@ static const struct net_device_ops gs_usb_netdev_ops = {
static int gs_usb_set_identify(struct net_device *netdev, bool do_identify) static int gs_usb_set_identify(struct net_device *netdev, bool do_identify)
{ {
struct gs_can *dev = netdev_priv(netdev); struct gs_can *dev = netdev_priv(netdev);
struct gs_identify_mode imode; struct gs_identify_mode *imode;
int rc; int rc;
imode = kmalloc(sizeof(*imode), GFP_KERNEL);
if (!imode)
return -ENOMEM;
if (do_identify) if (do_identify)
imode.mode = GS_CAN_IDENTIFY_ON; imode->mode = GS_CAN_IDENTIFY_ON;
else else
imode.mode = GS_CAN_IDENTIFY_OFF; imode->mode = GS_CAN_IDENTIFY_OFF;
rc = usb_control_msg(interface_to_usbdev(dev->iface), rc = usb_control_msg(interface_to_usbdev(dev->iface),
usb_sndctrlpipe(interface_to_usbdev(dev->iface), usb_sndctrlpipe(interface_to_usbdev(dev->iface),
...@@ -755,10 +760,12 @@ static int gs_usb_set_identify(struct net_device *netdev, bool do_identify) ...@@ -755,10 +760,12 @@ static int gs_usb_set_identify(struct net_device *netdev, bool do_identify)
USB_RECIP_INTERFACE, USB_RECIP_INTERFACE,
dev->channel, dev->channel,
0, 0,
&imode, imode,
sizeof(imode), sizeof(*imode),
100); 100);
kfree(imode);
return (rc > 0) ? 0 : rc; return (rc > 0) ? 0 : rc;
} }
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册