diff options
| author | Johan Hovold <jhovold@gmail.com> | 2009-12-28 23:01:55 +0100 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@suse.de> | 2010-09-20 13:17:47 -0700 |
| commit | 1c4a6ee759c50b18a591e6b9c89687cdf9382724 (patch) | |
| tree | a7434507f21298439ad6ba3af229a65297711a8e /drivers | |
| parent | 694cdee9bd697775de829418203f35ce9e83829b (diff) | |
USB: mos7840: fix DMA buffers on stack and endianess bugs
commit 9e221a35f82cbef0397d81fed588bafba95b550c upstream.
Signed-off-by: Johan Hovold <jhovold@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/usb/serial/mos7840.c | 22 |
1 files changed, 18 insertions, 4 deletions
diff --git a/drivers/usb/serial/mos7840.c b/drivers/usb/serial/mos7840.c index 593478442fc1..3bef032aaa72 100644 --- a/drivers/usb/serial/mos7840.c +++ b/drivers/usb/serial/mos7840.c @@ -286,12 +286,19 @@ static int mos7840_get_reg_sync(struct usb_serial_port *port, __u16 reg, { struct usb_device *dev = port->serial->dev; int ret = 0; + u8 *buf; + + buf = kmalloc(VENDOR_READ_LENGTH, GFP_KERNEL); + if (!buf) + return -ENOMEM; ret = usb_control_msg(dev, usb_rcvctrlpipe(dev, 0), MCS_RDREQ, - MCS_RD_RTYPE, 0, reg, val, VENDOR_READ_LENGTH, + MCS_RD_RTYPE, 0, reg, buf, VENDOR_READ_LENGTH, MOS_WDR_TIMEOUT); + *val = buf[0]; dbg("mos7840_get_reg_sync offset is %x, return val %x", reg, *val); - *val = (*val) & 0x00ff; + + kfree(buf); return ret; } @@ -344,6 +351,11 @@ static int mos7840_get_uart_reg(struct usb_serial_port *port, __u16 reg, struct usb_device *dev = port->serial->dev; int ret = 0; __u16 Wval; + u8 *buf; + + buf = kmalloc(VENDOR_READ_LENGTH, GFP_KERNEL); + if (!buf) + return -ENOMEM; /* dbg("application number is %4x", (((__u16)port->number - (__u16)(port->serial->minor))+1)<<8); */ @@ -367,9 +379,11 @@ static int mos7840_get_uart_reg(struct usb_serial_port *port, __u16 reg, } } ret = usb_control_msg(dev, usb_rcvctrlpipe(dev, 0), MCS_RDREQ, - MCS_RD_RTYPE, Wval, reg, val, VENDOR_READ_LENGTH, + MCS_RD_RTYPE, Wval, reg, buf, VENDOR_READ_LENGTH, MOS_WDR_TIMEOUT); - *val = (*val) & 0x00ff; + *val = buf[0]; + + kfree(buf); return ret; } |