From d0ef90b49857b403c1cfa62fce229c967dd4be40 Mon Sep 17 00:00:00 2001 From: Dan Carpenter Date: Thu, 31 Dec 2009 17:42:55 +0200 Subject: USB: serial: fix DMA buffers on stack for io_edgeport.c The original code was passing a stack variable as a dma buffer, so I made it an allocated variable. Instead of adding a bunch of kfree() calls, I changed all the error return paths to gotos. Also I noticed that the error checking wasn't correct because usb_get_descriptor() can return negative values. While I was at it, I made an unrelated white space change by moving the unicode_to_ascii() on to one line. Signed-off-by: Dan Carpenter Cc: Johan Hovold Signed-off-by: Greg Kroah-Hartman --- drivers/usb/serial/io_edgeport.c | 35 ++++++++++++++++++----------------- 1 file changed, 18 insertions(+), 17 deletions(-) (limited to 'drivers/usb') diff --git a/drivers/usb/serial/io_edgeport.c b/drivers/usb/serial/io_edgeport.c index b97960ac92f2..09456002bac0 100644 --- a/drivers/usb/serial/io_edgeport.c +++ b/drivers/usb/serial/io_edgeport.c @@ -372,31 +372,32 @@ static void update_edgeport_E2PROM(struct edgeport_serial *edge_serial) ************************************************************************/ static int get_string(struct usb_device *dev, int Id, char *string, int buflen) { - struct usb_string_descriptor StringDesc; - struct usb_string_descriptor *pStringDesc; + struct usb_string_descriptor *StringDesc = NULL; + struct usb_string_descriptor *pStringDesc = NULL; + int ret = 0; dbg("%s - USB String ID = %d", __func__, Id); - if (!usb_get_descriptor(dev, USB_DT_STRING, Id, - &StringDesc, sizeof(StringDesc))) - return 0; + StringDesc = kmalloc(sizeof(*StringDesc), GFP_KERNEL); + if (!StringDesc) + goto free; + if (usb_get_descriptor(dev, USB_DT_STRING, Id, StringDesc, sizeof(*StringDesc)) <= 0) + goto free; - pStringDesc = kmalloc(StringDesc.bLength, GFP_KERNEL); + pStringDesc = kmalloc(StringDesc->bLength, GFP_KERNEL); if (!pStringDesc) - return 0; + goto free; - if (!usb_get_descriptor(dev, USB_DT_STRING, Id, - pStringDesc, StringDesc.bLength)) { - kfree(pStringDesc); - return 0; - } - - unicode_to_ascii(string, buflen, - pStringDesc->wData, pStringDesc->bLength/2); + if (usb_get_descriptor(dev, USB_DT_STRING, Id, pStringDesc, StringDesc->bLength) <= 0) + goto free; - kfree(pStringDesc); + unicode_to_ascii(string, buflen, pStringDesc->wData, pStringDesc->bLength/2); + ret = strlen(string); dbg("%s - USB String %s", __func__, string); - return strlen(string); +free: + kfree(StringDesc); + kfree(pStringDesc); + return ret; } -- cgit v1.2.3