target/linux/generic/patches-3.9/008-hso-Fix-stack-corruption-on-some-architectures.patch

   1 From e75dc677ff8d06ffa61bef6fee436227ae5440c6 Mon Sep 17 00:00:00 2001
   2 From: Daniel Gimpelevich <daniel@gimpelevich.san-francisco.ca.us>
   3 Date: Wed, 21 Aug 2013 01:43:19 -0700
   4 Subject: [PATCH 2/2] hso: Fix stack corruption on some architectures
   5
   6 As Sergei Shtylyov explained in the #mipslinux IRC channel:
   7 [Mon 2013-08-19 12:28:21 PM PDT] <headless> guys, are you sure it's not "DMA off stack" case?
   8 [Mon 2013-08-19 12:28:35 PM PDT] <headless> it's a known stack corruptor on non-coherent arches
   9 [Mon 2013-08-19 12:31:48 PM PDT] <DonkeyHotei> headless: for usb/ehci?
  10 [Mon 2013-08-19 12:34:11 PM PDT] <DonkeyHotei> headless: explain
  11 [Mon 2013-08-19 12:35:38 PM PDT] <headless> usb_control_msg() (or other such func) should not use buffer on stack. DMA from/to stack is prohibited
  12 [Mon 2013-08-19 12:35:58 PM PDT] <headless> and EHCI uses DMA on control xfers (as well as all the others)
  13
  14 Signed-off-by: Daniel Gimpelevich <daniel@gimpelevich.san-francisco.ca.us>
  15 Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  16 Signed-off-by: David S. Miller <davem@davemloft.net>
  17 ---
  18  drivers/net/usb/hso.c |    6 +++++-
  19  1 file changed, 5 insertions(+), 1 deletion(-)
  20
  21 --- a/drivers/net/usb/hso.c
  22 +++ b/drivers/net/usb/hso.c
  23 @@ -2825,13 +2825,16 @@ exit:
  24  static int hso_get_config_data(struct usb_interface *interface)
  25  {
  26         struct usb_device *usbdev = interface_to_usbdev(interface);
  27 -       u8 config_data[17];
  28 +       u8 *config_data = kmalloc(17, GFP_KERNEL);
  29         u32 if_num = interface->altsetting->desc.bInterfaceNumber;
  30         s32 result;
  31
  32 +       if (!config_data)
  33 +               return -ENOMEM;
  34         if (usb_control_msg(usbdev, usb_rcvctrlpipe(usbdev, 0),
  35                             0x86, 0xC0, 0, 0, config_data, 17,
  36                             USB_CTRL_SET_TIMEOUT) != 0x11) {
  37 +               kfree(config_data);
  38                 return -EIO;
  39         }
  40
  41 @@ -2882,6 +2885,7 @@ static int hso_get_config_data(struct us
  42         if (config_data[16] & 0x1)
  43                 result |= HSO_INFO_CRC_BUG;
  44
  45 +       kfree(config_data);
  46         return result;
  47  }
  48