| From 15ee89c3347fbf58a4361011eda5ac2731e45126 Mon Sep 17 00:00:00 2001 |
| From: Johan Hovold <jhovold@gmail.com> |
| Date: Mon, 27 May 2013 14:44:40 +0200 |
| Subject: USB: mos7840: fix DMA to stack |
| |
| From: Johan Hovold <jhovold@gmail.com> |
| |
| commit 15ee89c3347fbf58a4361011eda5ac2731e45126 upstream. |
| |
| Fix regression introduced by commit 0eafe4de1a ("USB: serial: mos7840: |
| add support for MCS7810 devices") which used stack-allocated buffers for |
| control messages. |
| |
| Signed-off-by: Johan Hovold <jhovold@gmail.com> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| |
| --- |
| drivers/usb/serial/mos7840.c | 35 +++++++++++++++++++++++++++-------- |
| 1 file changed, 27 insertions(+), 8 deletions(-) |
| |
| --- a/drivers/usb/serial/mos7840.c |
| +++ b/drivers/usb/serial/mos7840.c |
| @@ -2255,13 +2255,21 @@ static int mos7840_ioctl(struct tty_stru |
| static int mos7810_check(struct usb_serial *serial) |
| { |
| int i, pass_count = 0; |
| + u8 *buf; |
| __u16 data = 0, mcr_data = 0; |
| __u16 test_pattern = 0x55AA; |
| + int res; |
| + |
| + buf = kmalloc(VENDOR_READ_LENGTH, GFP_KERNEL); |
| + if (!buf) |
| + return 0; /* failed to identify 7810 */ |
| |
| /* Store MCR setting */ |
| - usb_control_msg(serial->dev, usb_rcvctrlpipe(serial->dev, 0), |
| + res = usb_control_msg(serial->dev, usb_rcvctrlpipe(serial->dev, 0), |
| MCS_RDREQ, MCS_RD_RTYPE, 0x0300, MODEM_CONTROL_REGISTER, |
| - &mcr_data, VENDOR_READ_LENGTH, MOS_WDR_TIMEOUT); |
| + buf, VENDOR_READ_LENGTH, MOS_WDR_TIMEOUT); |
| + if (res == VENDOR_READ_LENGTH) |
| + mcr_data = *buf; |
| |
| for (i = 0; i < 16; i++) { |
| /* Send the 1-bit test pattern out to MCS7810 test pin */ |
| @@ -2271,9 +2279,12 @@ static int mos7810_check(struct usb_seri |
| MODEM_CONTROL_REGISTER, NULL, 0, MOS_WDR_TIMEOUT); |
| |
| /* Read the test pattern back */ |
| - usb_control_msg(serial->dev, usb_rcvctrlpipe(serial->dev, 0), |
| - MCS_RDREQ, MCS_RD_RTYPE, 0, GPIO_REGISTER, &data, |
| - VENDOR_READ_LENGTH, MOS_WDR_TIMEOUT); |
| + res = usb_control_msg(serial->dev, |
| + usb_rcvctrlpipe(serial->dev, 0), MCS_RDREQ, |
| + MCS_RD_RTYPE, 0, GPIO_REGISTER, buf, |
| + VENDOR_READ_LENGTH, MOS_WDR_TIMEOUT); |
| + if (res == VENDOR_READ_LENGTH) |
| + data = *buf; |
| |
| /* If this is a MCS7810 device, both test patterns must match */ |
| if (((test_pattern >> i) ^ (~data >> 1)) & 0x0001) |
| @@ -2287,6 +2298,8 @@ static int mos7810_check(struct usb_seri |
| MCS_WR_RTYPE, 0x0300 | mcr_data, MODEM_CONTROL_REGISTER, NULL, |
| 0, MOS_WDR_TIMEOUT); |
| |
| + kfree(buf); |
| + |
| if (pass_count == 16) |
| return 1; |
| |
| @@ -2296,11 +2309,17 @@ static int mos7810_check(struct usb_seri |
| static int mos7840_calc_num_ports(struct usb_serial *serial) |
| { |
| __u16 data = 0x00; |
| + u8 *buf; |
| int mos7840_num_ports; |
| |
| - usb_control_msg(serial->dev, usb_rcvctrlpipe(serial->dev, 0), |
| - MCS_RDREQ, MCS_RD_RTYPE, 0, GPIO_REGISTER, &data, |
| - VENDOR_READ_LENGTH, MOS_WDR_TIMEOUT); |
| + buf = kzalloc(VENDOR_READ_LENGTH, GFP_KERNEL); |
| + if (buf) { |
| + usb_control_msg(serial->dev, usb_rcvctrlpipe(serial->dev, 0), |
| + MCS_RDREQ, MCS_RD_RTYPE, 0, GPIO_REGISTER, buf, |
| + VENDOR_READ_LENGTH, MOS_WDR_TIMEOUT); |
| + data = *buf; |
| + kfree(buf); |
| + } |
| |
| if (serial->dev->descriptor.idProduct == MOSCHIP_DEVICE_ID_7810 || |
| serial->dev->descriptor.idProduct == MOSCHIP_DEVICE_ID_7820) { |