| From 065e60964e293227e4feb0c1f7e27e609316ed9a Mon Sep 17 00:00:00 2001 |
| From: Adam Cozzette <acozzette@cs.hmc.edu> |
| Date: Wed, 24 Aug 2011 12:22:37 -0600 |
| Subject: ums_realtek: do not use stack memory for DMA |
| |
| From: Adam Cozzette <acozzette@cs.hmc.edu> |
| |
| commit 065e60964e293227e4feb0c1f7e27e609316ed9a upstream. |
| |
| This patch changes rts51x_read_mem, rts51x_write_mem, and rts51x_read_status to |
| allocate temporary buffers with kmalloc. This way stack addresses are not used |
| for DMA when these functions call rts51x_bulk_transport. |
| |
| Signed-off-by: Adam Cozzette <acozzette@cs.hmc.edu> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> |
| |
| --- |
| drivers/usb/storage/realtek_cr.c | 35 ++++++++++++++++++++++++++++++----- |
| 1 file changed, 30 insertions(+), 5 deletions(-) |
| |
| --- a/drivers/usb/storage/realtek_cr.c |
| +++ b/drivers/usb/storage/realtek_cr.c |
| @@ -320,6 +320,11 @@ static int rts51x_read_mem(struct us_dat |
| { |
| int retval; |
| u8 cmnd[12] = { 0 }; |
| + u8 *buf; |
| + |
| + buf = kmalloc(len, GFP_NOIO); |
| + if (buf == NULL) |
| + return USB_STOR_TRANSPORT_ERROR; |
| |
| US_DEBUGP("%s, addr = 0x%x, len = %d\n", __func__, addr, len); |
| |
| @@ -331,10 +336,14 @@ static int rts51x_read_mem(struct us_dat |
| cmnd[5] = (u8) len; |
| |
| retval = rts51x_bulk_transport(us, 0, cmnd, 12, |
| - data, len, DMA_FROM_DEVICE, NULL); |
| - if (retval != USB_STOR_TRANSPORT_GOOD) |
| + buf, len, DMA_FROM_DEVICE, NULL); |
| + if (retval != USB_STOR_TRANSPORT_GOOD) { |
| + kfree(buf); |
| return -EIO; |
| + } |
| |
| + memcpy(data, buf, len); |
| + kfree(buf); |
| return 0; |
| } |
| |
| @@ -342,6 +351,12 @@ static int rts51x_write_mem(struct us_da |
| { |
| int retval; |
| u8 cmnd[12] = { 0 }; |
| + u8 *buf; |
| + |
| + buf = kmalloc(len, GFP_NOIO); |
| + if (buf == NULL) |
| + return USB_STOR_TRANSPORT_ERROR; |
| + memcpy(buf, data, len); |
| |
| US_DEBUGP("%s, addr = 0x%x, len = %d\n", __func__, addr, len); |
| |
| @@ -353,7 +368,8 @@ static int rts51x_write_mem(struct us_da |
| cmnd[5] = (u8) len; |
| |
| retval = rts51x_bulk_transport(us, 0, cmnd, 12, |
| - data, len, DMA_TO_DEVICE, NULL); |
| + buf, len, DMA_TO_DEVICE, NULL); |
| + kfree(buf); |
| if (retval != USB_STOR_TRANSPORT_GOOD) |
| return -EIO; |
| |
| @@ -365,6 +381,11 @@ static int rts51x_read_status(struct us_ |
| { |
| int retval; |
| u8 cmnd[12] = { 0 }; |
| + u8 *buf; |
| + |
| + buf = kmalloc(len, GFP_NOIO); |
| + if (buf == NULL) |
| + return USB_STOR_TRANSPORT_ERROR; |
| |
| US_DEBUGP("%s, lun = %d\n", __func__, lun); |
| |
| @@ -372,10 +393,14 @@ static int rts51x_read_status(struct us_ |
| cmnd[1] = 0x09; |
| |
| retval = rts51x_bulk_transport(us, lun, cmnd, 12, |
| - status, len, DMA_FROM_DEVICE, actlen); |
| - if (retval != USB_STOR_TRANSPORT_GOOD) |
| + buf, len, DMA_FROM_DEVICE, actlen); |
| + if (retval != USB_STOR_TRANSPORT_GOOD) { |
| + kfree(buf); |
| return -EIO; |
| + } |
| |
| + memcpy(status, buf, len); |
| + kfree(buf); |
| return 0; |
| } |
| |