net: can: usb: gs_usb: Fix buffer on stack

commit b05c73bd1e3ec60357580eb042ee932a5ed754d5 upstream.

Allocate buffers on HEAP instead of STACK for local structures
that are to be sent using usb_control_msg().

Signed-off-by: Maksim Salau <maksim.salau@gmail.com>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

1 files changed, 12 insertions, 5 deletions

diff --git a/drivers/net/can/usb/gs_usb.c b/drivers/net/can/usb/gs_usb.c
index a0dabd4038ba..7ab24c5262f3 100644
--- a/drivers/net/can/usb/gs_usb.c
+++ b/drivers/net/can/usb/gs_usb.c
@@ -740,13 +740,18 @@ static const struct net_device_ops gs_usb_netdev_ops = {
 static int gs_usb_set_identify(struct net_device *netdev, bool do_identify)
 {
         struct gs_can *dev = netdev_priv(netdev);
-        struct gs_identify_mode imode;
+        struct gs_identify_mode *imode;
         int rc;
 
+        imode = kmalloc(sizeof(*imode), GFP_KERNEL);
+
+        if (!imode)
+                return -ENOMEM;
+
         if (do_identify)
-                imode.mode = GS_CAN_IDENTIFY_ON;
+                imode->mode = GS_CAN_IDENTIFY_ON;
         else
-                imode.mode = GS_CAN_IDENTIFY_OFF;
+                imode->mode = GS_CAN_IDENTIFY_OFF;
 
         rc = usb_control_msg(interface_to_usbdev(dev->iface),
                              usb_sndctrlpipe(interface_to_usbdev(dev->iface),
@@ -756,10 +761,12 @@ static int gs_usb_set_identify(struct net_device *netdev, bool do_identify)
                              USB_RECIP_INTERFACE,
                              dev->channel,
                              0,
-                             &imode,
-                             sizeof(imode),
+                             imode,
+                             sizeof(*imode),
                              100);
 
+        kfree(imode);
+
         return (rc > 0) ? 0 : rc;
 }