USB: visor: fix DMA buffers on stack

Signed-off-by: Johan Hovold <jhovold@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

1 files changed, 18 insertions, 8 deletions

diff --git a/drivers/usb/serial/visor.c b/drivers/usb/serial/visor.c
index ad1f9232292d..178e4d9abb27 100644
--- a/drivers/usb/serial/visor.c
+++ b/drivers/usb/serial/visor.c
@@ -807,10 +807,14 @@ static int clie_3_5_startup(struct usb_serial *serial)
 {
         struct device *dev = &serial->dev->dev;
         int result;
-        u8 data;
+        u8 *data;
 
         dbg("%s", __func__);
 
+        data = kmalloc(1, GFP_KERNEL);
+        if (!data)
+                return -ENOMEM;
+
         /*
          * Note that PEG-300 series devices expect the following two calls.
          */
@@ -818,36 +822,42 @@ static int clie_3_5_startup(struct usb_serial *serial)
         /* get the config number */
         result = usb_control_msg(serial->dev, usb_rcvctrlpipe(serial->dev, 0),
                                   USB_REQ_GET_CONFIGURATION, USB_DIR_IN,
-                                  0, 0, &data, 1, 3000);
+                                  0, 0, data, 1, 3000);
         if (result < 0) {
                 dev_err(dev, "%s: get config number failed: %d\n",
                                                         __func__, result);
-                return result;
+                goto out;
         }
         if (result != 1) {
                 dev_err(dev, "%s: get config number bad return length: %d\n",
                                                         __func__, result);
-                return -EIO;
+                result = -EIO;
+                goto out;
         }
 
         /* get the interface number */
         result = usb_control_msg(serial->dev, usb_rcvctrlpipe(serial->dev, 0),
                                   USB_REQ_GET_INTERFACE,
                                   USB_DIR_IN | USB_RECIP_INTERFACE,
-                                  0, 0, &data, 1, 3000);
+                                  0, 0, data, 1, 3000);
         if (result < 0) {
                 dev_err(dev, "%s: get interface number failed: %d\n",
                                                         __func__, result);
-                return result;
+                goto out;
         }
         if (result != 1) {
                 dev_err(dev,
                         "%s: get interface number bad return length: %d\n",
                                                         __func__, result);
-                return -EIO;
+                result = -EIO;
+                goto out;
         }
 
-        return generic_startup(serial);
+        result = generic_startup(serial);
+out:
+        kfree(data);
+
+        return result;
 }
 
 static int treo_attach(struct usb_serial *serial)