1 files changed, 13 insertions, 5 deletions

diff --git a/drivers/media/usb/siano/smsusb.c b/drivers/media/usb/siano/smsusb.c
index a4dcaec31d02..8c1f926567ec 100644
--- a/drivers/media/usb/siano/smsusb.c
+++ b/drivers/media/usb/siano/smsusb.c
@@ -218,22 +218,30 @@ static int smsusb_start_streaming(struct smsusb_device_t *dev)
 static int smsusb_sendrequest(void *context, void *buffer, size_t size)
 {
         struct smsusb_device_t *dev = (struct smsusb_device_t *) context;
-        struct sms_msg_hdr *phdr = (struct sms_msg_hdr *) buffer;
-        int dummy;
+        struct sms_msg_hdr *phdr;
+        int dummy, ret;
 
         if (dev->state != SMSUSB_ACTIVE) {
                 pr_debug("Device not active yet\n");
                 return -ENOENT;
         }
 
+        phdr = kmalloc(size, GFP_KERNEL);
+        if (!phdr)
+                return -ENOMEM;
+        memcpy(phdr, buffer, size);
+
         pr_debug("sending %s(%d) size: %d\n",
                   smscore_translate_msg(phdr->msg_type), phdr->msg_type,
                   phdr->msg_length);
 
         smsendian_handle_tx_message((struct sms_msg_data *) phdr);
-        smsendian_handle_message_header((struct sms_msg_hdr *)buffer);
-        return usb_bulk_msg(dev->udev, usb_sndbulkpipe(dev->udev, 2),
-                            buffer, size, &dummy, 1000);
+        smsendian_handle_message_header((struct sms_msg_hdr *)phdr);
+        ret = usb_bulk_msg(dev->udev, usb_sndbulkpipe(dev->udev, 2),
+                            phdr, size, &dummy, 1000);
+
+        kfree(phdr);
+        return ret;
 }
 
 static char *smsusb1_fw_lkup[] = {