[media] cpia2_usb: don't use stack for DMA

The USB control messages require DMA to work. We cannot pass
a stack-allocated buffer, as it is not warranted that the
stack would be into a DMA enabled area.

Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>

1 files changed, 30 insertions, 4 deletions

diff --git a/drivers/media/usb/cpia2/cpia2_usb.c b/drivers/media/usb/cpia2/cpia2_usb.c
index 13620cdf0599..e9100a235831 100644
--- a/drivers/media/usb/cpia2/cpia2_usb.c
+++ b/drivers/media/usb/cpia2/cpia2_usb.c
@@ -545,18 +545,30 @@ static void free_sbufs(struct camera_data *cam)
 static int write_packet(struct usb_device *udev,
                         u8 request, u8 * registers, u16 start, size_t size)
 {
+        unsigned char *buf;
+        int ret;
+
         if (!registers || size <= 0)
                 return -EINVAL;
 
-        return usb_control_msg(udev,
+        buf = kmalloc(size, GFP_KERNEL);
+        if (!buf)
+                return -ENOMEM;
+
+        memcpy(buf, registers, size);
+
+        ret = usb_control_msg(udev,
                                usb_sndctrlpipe(udev, 0),
                                request,
                                USB_TYPE_VENDOR | USB_RECIP_DEVICE,
                                start,   /* value */
                                0,       /* index */
-                               registers,       /* buffer */
+                               buf,     /* buffer */
                                size,
                                HZ);
+
+        kfree(buf);
+        return ret;
 }
 
 /****************************************************************************
@@ -567,18 +579,32 @@ static int write_packet(struct usb_device *udev,
 static int read_packet(struct usb_device *udev,
                        u8 request, u8 * registers, u16 start, size_t size)
 {
+        unsigned char *buf;
+        int ret;
+
         if (!registers || size <= 0)
                 return -EINVAL;
 
-        return usb_control_msg(udev,
+        buf = kmalloc(size, GFP_KERNEL);
+        if (!buf)
+                return -ENOMEM;
+
+        ret = usb_control_msg(udev,
                                usb_rcvctrlpipe(udev, 0),
                                request,
                                USB_DIR_IN|USB_TYPE_VENDOR|USB_RECIP_DEVICE,
                                start,   /* value */
                                0,       /* index */
-                               registers,       /* buffer */
+                               buf,     /* buffer */
                                size,
                                HZ);
+
+        if (ret >= 0)
+                memcpy(registers, buf, size);
+
+        kfree(buf);
+
+        return ret;
 }
 
 /******************************************************************************