USB: mos7720: fix DMA buffers on stack and clean up send_mos_cmd

Change data-argument type from (void *) to (u8 *) to prevent endianess
problems.

Signed-off-by: Johan Hovold <jhovold@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

1 files changed, 17 insertions, 17 deletions

diff --git a/drivers/usb/serial/mos7720.c b/drivers/usb/serial/mos7720.c
index 763e32a44be..e081dc0d21d 100644
--- a/drivers/usb/serial/mos7720.c
+++ b/drivers/usb/serial/mos7720.c
@@ -275,13 +275,11 @@ static void mos7720_bulk_out_data_callback(struct urb *urb)
  *      this function will be used for sending command to device
  */
 static int send_mos_cmd(struct usb_serial *serial, __u8 request, __u16 value,
-                        __u16 index, void *data)
+                        __u16 index, u8 *data)
 {
         int status;
-        unsigned int pipe;
+        u8 *buf;
         u16 product = le16_to_cpu(serial->dev->descriptor.idProduct);
-        __u8 requesttype;
-        __u16 size = 0x0000;
 
         if (value < MOS_MAX_PORT) {
                 if (product == MOSCHIP_DEVICE_ID_7715)
@@ -298,21 +296,23 @@ static int send_mos_cmd(struct usb_serial *serial, __u8 request, __u16 value,
         }
 
         if (request == MOS_WRITE) {
-                request = (__u8)MOS_WRITE;
-                requesttype = (__u8)0x40;
-                value  = value + (__u16)*((unsigned char *)data);
-                data = NULL;
-                pipe = usb_sndctrlpipe(serial->dev, 0);
+                value = value + *data;
+                status = usb_control_msg(serial->dev,
+                                usb_sndctrlpipe(serial->dev, 0), MOS_WRITE,
+                                0x40, value, index, NULL, 0, MOS_WDR_TIMEOUT);
         } else {
-                request = (__u8)MOS_READ;
-                requesttype = (__u8)0xC0;
-                size = 0x01;
-                pipe = usb_rcvctrlpipe(serial->dev, 0);
+                buf = kmalloc(1, GFP_KERNEL);
+                if (!buf) {
+                        status = -ENOMEM;
+                        goto out;
+                }
+                status = usb_control_msg(serial->dev,
+                                usb_rcvctrlpipe(serial->dev, 0), MOS_READ,
+                                0xc0, value, index, buf, 1, MOS_WDR_TIMEOUT);
+                *data = *buf;
+                kfree(buf);
         }
-
-        status = usb_control_msg(serial->dev, pipe, request, requesttype,
-                                 value, index, data, size, MOS_WDR_TIMEOUT);
-
+out:
         if (status < 0)
                 dbg("Command Write failed Value %x index %x\n", value, index);