USB: visor: fix DMA buffers on stack

Signed-off-by: Johan Hovold <jhovold@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

diff --git a/drivers/usb/serial/visor.c b/drivers/usb/serial/visor.c
index ad1f9232292d264506b16cb5b5bd8a625dc2e88d..178e4d9abb273841d29b46cf7bedca2180def507 100644 (file)
--- a/drivers/usb/serial/visor.c
+++ b/drivers/usb/serial/visor.c
@@ -807,10 +807,14 @@ static int clie_3_5_startup(struct usb_serial *serial)
 {
        struct device *dev = &serial->dev->dev;
        int result;
-       u8 data;
+       u8 *data;
 
        dbg("%s", __func__);
 
+       data = kmalloc(1, GFP_KERNEL);
+       if (!data)
+               return -ENOMEM;
+
        /*
         * Note that PEG-300 series devices expect the following two calls.
         */
@@ -818,36 +822,42 @@ static int clie_3_5_startup(struct usb_serial *serial)
        /* get the config number */
        result = usb_control_msg(serial->dev, usb_rcvctrlpipe(serial->dev, 0),
                                  USB_REQ_GET_CONFIGURATION, USB_DIR_IN,
-                                 0, 0, &data, 1, 3000);
+                                 0, 0, data, 1, 3000);
        if (result < 0) {
                dev_err(dev, "%s: get config number failed: %d\n",
                                                        __func__, result);
-               return result;
+               goto out;
        }
        if (result != 1) {
                dev_err(dev, "%s: get config number bad return length: %d\n",
                                                        __func__, result);
-               return -EIO;
+               result = -EIO;
+               goto out;
        }
 
        /* get the interface number */
        result = usb_control_msg(serial->dev, usb_rcvctrlpipe(serial->dev, 0),
                                  USB_REQ_GET_INTERFACE,
                                  USB_DIR_IN | USB_RECIP_INTERFACE,
-                                 0, 0, &data, 1, 3000);
+                                 0, 0, data, 1, 3000);
        if (result < 0) {
                dev_err(dev, "%s: get interface number failed: %d\n",
                                                        __func__, result);
-               return result;
+               goto out;
        }
        if (result != 1) {
                dev_err(dev,
                        "%s: get interface number bad return length: %d\n",
                                                        __func__, result);
-               return -EIO;
+               result = -EIO;
+               goto out;
        }
 
-       return generic_startup(serial);
+       result = generic_startup(serial);
+out:
+       kfree(data);
+
+       return result;
 }
 
 static int treo_attach(struct usb_serial *serial)