1 files changed, 9 insertions, 2 deletions

diff --git a/drivers/usb/serial/opticon.c b/drivers/usb/serial/opticon.c
index 41b1647306eb..6aba731d4864 100644
--- a/drivers/usb/serial/opticon.c
+++ b/drivers/usb/serial/opticon.c
@@ -155,7 +155,11 @@ static int send_control_msg(struct usb_serial_port *port, u8 requesttype,
 {
         struct usb_serial *serial = port->serial;
         int retval;
-        u8 buffer[2];
+        u8 *buffer;
+
+        buffer = kzalloc(1, GFP_KERNEL);
+        if (!buffer)
+                return -ENOMEM;
 
         buffer[0] = val;
         /* Send the message to the vendor control endpoint
@@ -164,6 +168,7 @@ static int send_control_msg(struct usb_serial_port *port, u8 requesttype,
                                 requesttype,
                                 USB_DIR_OUT|USB_TYPE_VENDOR|USB_RECIP_INTERFACE,
                                 0, 0, buffer, 1, 0);
+        kfree(buffer);
 
         return retval;
 }
@@ -281,7 +286,7 @@ static int opticon_write(struct tty_struct *tty, struct usb_serial_port *port,
         if (!dr) {
                 dev_err(&port->dev, "out of memory\n");
                 count = -ENOMEM;
-                goto error;
+                goto error_no_dr;
         }
 
         dr->bRequestType = USB_TYPE_VENDOR | USB_RECIP_INTERFACE | USB_DIR_OUT;
@@ -311,6 +316,8 @@ static int opticon_write(struct tty_struct *tty, struct usb_serial_port *port,
 
         return count;
 error:
+        kfree(dr);
+error_no_dr:
         usb_free_urb(urb);
 error_no_urb:
         kfree(buffer);