synclink fix ldisc buffer argument

Fix call to line discipline receive_buf by synclink drivers.
Dummy flag buffer argument is ignored by N_HDLC line discipline but might
be of insufficient size if accessed by a different line discipline
selected by mistake. flag buffer allocation now matches max size of data
buffer. Unused char_buf buffers are removed.

Signed-off-by: Paul Fulghum <paulkf@microgate.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

1 files changed, 11 insertions, 1 deletions

diff --git a/drivers/char/pcmcia/synclink_cs.c b/drivers/char/pcmcia/synclink_cs.c
index b66eaa04f8cb..b2f35d786025 100644
--- a/drivers/char/pcmcia/synclink_cs.c
+++ b/drivers/char/pcmcia/synclink_cs.c
@@ -210,7 +210,7 @@ typedef struct _mgslpc_info {
         char testing_irq;
         unsigned int init_error;        /* startup error (DIAGS)        */
 
-        char flag_buf[MAX_ASYNC_BUFFER_SIZE];
+        char *flag_buf;
         bool drop_rts_on_tx_done;
 
         struct  _input_signal_events    input_signal_events;
@@ -2674,6 +2674,14 @@ static int rx_alloc_buffers(MGSLPC_INFO *info)
         if (info->rx_buf == NULL)
                 return -ENOMEM;
 
+        /* unused flag buffer to satisfy receive_buf calling interface */
+        info->flag_buf = kzalloc(info->max_frame_size, GFP_KERNEL);
+        if (!info->flag_buf) {
+                kfree(info->rx_buf);
+                info->rx_buf = NULL;
+                return -ENOMEM;
+        }
+        
         rx_reset_buffers(info);
         return 0;
 }
@@ -2682,6 +2690,8 @@ static void rx_free_buffers(MGSLPC_INFO *info)
 {
         kfree(info->rx_buf);
         info->rx_buf = NULL;
+        kfree(info->flag_buf);
+        info->flag_buf = NULL;
 }
 
 static int claim_resources(MGSLPC_INFO *info)