ChangeSet 1.1500.8.15, 2004/02/02 13:45:27-08:00, oliver@neukum.org

[PATCH] USB: fix DMA to stack in tt-usb

this driver does DMA to the stack via usb_bulk_msg().


 drivers/media/dvb/ttusb-dec/ttusb_dec.c |   25 +++++++++++++++++++++----
 1 files changed, 21 insertions(+), 4 deletions(-)


diff -Nru a/drivers/media/dvb/ttusb-dec/ttusb_dec.c b/drivers/media/dvb/ttusb-dec/ttusb_dec.c
--- a/drivers/media/dvb/ttusb-dec/ttusb_dec.c	Mon Feb  9 14:40:09 2004
+++ b/drivers/media/dvb/ttusb-dec/ttusb_dec.c	Mon Feb  9 14:40:09 2004
@@ -204,12 +204,23 @@
 				  int *result_length, u8 cmd_result[])
 {
 	int result, actual_len, i;
-	u8 b[COMMAND_PACKET_SIZE + 4];
-	u8 c[COMMAND_PACKET_SIZE + 4];
+	u8 *b;
+	u8 *c;
+	
+	b = kmalloc(COMMAND_PACKET_SIZE + 4, GFP_KERNEL);
+	if (!b)
+		return -ENOMEM;
+	c = kmalloc(COMMAND_PACKET_SIZE + 4, GFP_KERNEL);
+	if (!c) {
+		kfree(b);
+		return -ENOMEM;
+	}
 
 	dprintk("%s\n", __FUNCTION__);
 
 	if ((result = down_interruptible(&dec->usb_sem))) {
+		kfree(b);
+		kfree(c);
 		printk("%s: Failed to down usb semaphore.\n", __FUNCTION__);
 		return result;
 	}
@@ -230,22 +241,26 @@
 	}
 
 	result = usb_bulk_msg(dec->udev, dec->command_pipe, b,
-			      sizeof(b), &actual_len, HZ);
+			      COMMAND_PACKET_SIZE + 4, &actual_len, HZ);
 
 	if (result) {
 		printk("%s: command bulk message failed: error %d\n",
 		       __FUNCTION__, result);
 		up(&dec->usb_sem);
+		kfree(b);
+		kfree(c);
 		return result;
 	}
 
 	result = usb_bulk_msg(dec->udev, dec->result_pipe, c,
-			      sizeof(c), &actual_len, HZ);
+			      COMMAND_PACKET_SIZE + 4, &actual_len, HZ);
 
 	if (result) {
 		printk("%s: result bulk message failed: error %d\n",
 		       __FUNCTION__, result);
 		up(&dec->usb_sem);
+		kfree(b);
+		kfree(c);
 		return result;
 	} else {
 		if (debug) {
@@ -262,6 +277,8 @@
 
 		up(&dec->usb_sem);
 
+		kfree(b);
+		kfree(c);
 		return 0;
 	}
 }