diff options
author | jwboyer@redhat.com <jwboyer@redhat.com> | 2012-02-20 15:34:34 -0500 |
---|---|---|
committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2012-02-24 16:37:45 -0500 |
commit | 4898e07174b79013afd2b422ef6c4336ef8e6783 (patch) | |
tree | 2619e8211fb6880fdca366c755df7a4dc35a9ae1 /drivers/usb | |
parent | 28c56ea1431421dec51b7b229369e991481453df (diff) |
USB: ums_realtek: do not use stack memory for DMA in __do_config_autodelink
__do_config_autodelink passes the data variable to the transport function.
If the calling functions pass a stack variable, this will eventually trigger
a DMA-API debug backtrace for mapping stack memory in the DMA buffer. Fix
this by calling kmemdup for the passed data instead.
Signed-off-by: Josh Boyer <jwboyer@redhat.com>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers/usb')
-rw-r--r-- | drivers/usb/storage/realtek_cr.c | 8 |
1 files changed, 7 insertions, 1 deletions
diff --git a/drivers/usb/storage/realtek_cr.c b/drivers/usb/storage/realtek_cr.c index b1c2fe8b6dcd..84a4bc0cbee4 100644 --- a/drivers/usb/storage/realtek_cr.c +++ b/drivers/usb/storage/realtek_cr.c | |||
@@ -507,9 +507,14 @@ static int __do_config_autodelink(struct us_data *us, u8 *data, u16 len) | |||
507 | { | 507 | { |
508 | int retval; | 508 | int retval; |
509 | u8 cmnd[12] = {0}; | 509 | u8 cmnd[12] = {0}; |
510 | u8 *buf; | ||
510 | 511 | ||
511 | US_DEBUGP("%s, addr = 0xfe47, len = %d\n", __FUNCTION__, len); | 512 | US_DEBUGP("%s, addr = 0xfe47, len = %d\n", __FUNCTION__, len); |
512 | 513 | ||
514 | buf = kmemdup(data, len, GFP_NOIO); | ||
515 | if (!buf) | ||
516 | return USB_STOR_TRANSPORT_ERROR; | ||
517 | |||
513 | cmnd[0] = 0xF0; | 518 | cmnd[0] = 0xF0; |
514 | cmnd[1] = 0x0E; | 519 | cmnd[1] = 0x0E; |
515 | cmnd[2] = 0xfe; | 520 | cmnd[2] = 0xfe; |
@@ -517,7 +522,8 @@ static int __do_config_autodelink(struct us_data *us, u8 *data, u16 len) | |||
517 | cmnd[4] = (u8)(len >> 8); | 522 | cmnd[4] = (u8)(len >> 8); |
518 | cmnd[5] = (u8)len; | 523 | cmnd[5] = (u8)len; |
519 | 524 | ||
520 | retval = rts51x_bulk_transport_special(us, 0, cmnd, 12, data, len, DMA_TO_DEVICE, NULL); | 525 | retval = rts51x_bulk_transport_special(us, 0, cmnd, 12, buf, len, DMA_TO_DEVICE, NULL); |
526 | kfree(buf); | ||
521 | if (retval != USB_STOR_TRANSPORT_GOOD) { | 527 | if (retval != USB_STOR_TRANSPORT_GOOD) { |
522 | return -EIO; | 528 | return -EIO; |
523 | } | 529 | } |