summaryrefslogtreecommitdiff
path: root/drivers/usb/storage
diff options
context:
space:
mode:
authorjwboyer@redhat.com <jwboyer@redhat.com>2012-02-20 15:34:34 -0500
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>2012-02-24 13:37:45 -0800
commit4898e07174b79013afd2b422ef6c4336ef8e6783 (patch)
tree2619e8211fb6880fdca366c755df7a4dc35a9ae1 /drivers/usb/storage
parent28c56ea1431421dec51b7b229369e991481453df (diff)
downloadlinux-3.10-4898e07174b79013afd2b422ef6c4336ef8e6783.tar.gz
linux-3.10-4898e07174b79013afd2b422ef6c4336ef8e6783.tar.bz2
linux-3.10-4898e07174b79013afd2b422ef6c4336ef8e6783.zip
USB: ums_realtek: do not use stack memory for DMA in __do_config_autodelink
__do_config_autodelink passes the data variable to the transport function. If the calling functions pass a stack variable, this will eventually trigger a DMA-API debug backtrace for mapping stack memory in the DMA buffer. Fix this by calling kmemdup for the passed data instead. Signed-off-by: Josh Boyer <jwboyer@redhat.com> Cc: stable <stable@vger.kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers/usb/storage')
-rw-r--r--drivers/usb/storage/realtek_cr.c8
1 files changed, 7 insertions, 1 deletions
diff --git a/drivers/usb/storage/realtek_cr.c b/drivers/usb/storage/realtek_cr.c
index b1c2fe8b6dc..84a4bc0cbee 100644
--- a/drivers/usb/storage/realtek_cr.c
+++ b/drivers/usb/storage/realtek_cr.c
@@ -507,9 +507,14 @@ static int __do_config_autodelink(struct us_data *us, u8 *data, u16 len)
{
int retval;
u8 cmnd[12] = {0};
+ u8 *buf;
US_DEBUGP("%s, addr = 0xfe47, len = %d\n", __FUNCTION__, len);
+ buf = kmemdup(data, len, GFP_NOIO);
+ if (!buf)
+ return USB_STOR_TRANSPORT_ERROR;
+
cmnd[0] = 0xF0;
cmnd[1] = 0x0E;
cmnd[2] = 0xfe;
@@ -517,7 +522,8 @@ static int __do_config_autodelink(struct us_data *us, u8 *data, u16 len)
cmnd[4] = (u8)(len >> 8);
cmnd[5] = (u8)len;
- retval = rts51x_bulk_transport_special(us, 0, cmnd, 12, data, len, DMA_TO_DEVICE, NULL);
+ retval = rts51x_bulk_transport_special(us, 0, cmnd, 12, buf, len, DMA_TO_DEVICE, NULL);
+ kfree(buf);
if (retval != USB_STOR_TRANSPORT_GOOD) {
return -EIO;
}