1 files changed, 13 insertions, 2 deletions

diff --git a/drivers/media/usb/s2255/s2255drv.c b/drivers/media/usb/s2255/s2255drv.c
index c3a0e87066eb..f7bb78c1873c 100644
--- a/drivers/media/usb/s2255/s2255drv.c
+++ b/drivers/media/usb/s2255/s2255drv.c
@@ -1901,19 +1901,30 @@ static long s2255_vendor_req(struct s2255_dev *dev, unsigned char Request,
                              s32 TransferBufferLength, int bOut)
 {
         int r;
+        unsigned char *buf;
+
+        buf = kmalloc(TransferBufferLength, GFP_KERNEL);
+        if (!buf)
+                return -ENOMEM;
+
         if (!bOut) {
                 r = usb_control_msg(dev->udev, usb_rcvctrlpipe(dev->udev, 0),
                                     Request,
                                     USB_TYPE_VENDOR | USB_RECIP_DEVICE |
                                     USB_DIR_IN,
-                                    Value, Index, TransferBuffer,
+                                    Value, Index, buf,
                                     TransferBufferLength, HZ * 5);
+
+                if (r >= 0)
+                        memcpy(TransferBuffer, buf, TransferBufferLength);
         } else {
+                memcpy(buf, TransferBuffer, TransferBufferLength);
                 r = usb_control_msg(dev->udev, usb_sndctrlpipe(dev->udev, 0),
                                     Request, USB_TYPE_VENDOR | USB_RECIP_DEVICE,
-                                    Value, Index, TransferBuffer,
+                                    Value, Index, buf,
                                     TransferBufferLength, HZ * 5);
         }
+        kfree(buf);
         return r;
 }