leandrof/linux
1
0
Fork 0
forked from Minki/linux
Code Issues Pull Requests Packages Projects Releases Wiki Activity

USB: quatech2: fix port DMA-buffer allocations

Browse Source 
Make sure serial DMA-buffers are allocated separately from containing
structure to prevent potential memory corruption on non-cache-coherent
systems.

Signed-off-by: Johan Hovold <jhovold@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Johan Hovold 2013-08-13 13:27:39 +02:00 committed by Greg Kroah-Hartman
parent 0448067150
commit cbf30a914e
1 changed files with 15 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

21
drivers/usb/serial/quatech2.c
View File

@ -122,7 +122,7 @@ struct qt2_port_private {
spinlock_t urb_lock;
bool urb_in_use;
struct urb *write_urb;
char write_buffer[QT2_WRITE_BUFFER_SIZE];
char *write_buffer;
spinlock_t lock;
u8 shadowLSR;
@ -755,21 +755,29 @@ static int qt2_port_probe(struct usb_serial_port *port)
spin_lock_init(&port_priv->urb_lock);
port_priv->port = port;
port_priv->write_buffer = kmalloc(QT2_WRITE_BUFFER_SIZE, GFP_KERNEL);
if (!port_priv->write_buffer)
goto err_buf;
port_priv->write_urb = usb_alloc_urb(0, GFP_KERNEL);
if (!port_priv->write_urb) {
kfree(port_priv);
return -ENOMEM;
}
if (!port_priv->write_urb)
goto err_urb;
bEndpointAddress = serial->port[0]->bulk_out_endpointAddress;
usb_fill_bulk_urb(port_priv->write_urb, serial->dev,
usb_sndbulkpipe(serial->dev, bEndpointAddress),
port_priv->write_buffer,
sizeof(port_priv->write_buffer),
QT2_WRITE_BUFFER_SIZE,
qt2_write_bulk_callback, port);
usb_set_serial_port_data(port, port_priv);
return 0;
err_urb:
kfree(port_priv->write_buffer);
err_buf:
kfree(port_priv);
return -ENOMEM;
}
static int qt2_port_remove(struct usb_serial_port *port)
@ -778,6 +786,7 @@ static int qt2_port_remove(struct usb_serial_port *port)
port_priv = usb_get_serial_port_data(port);
usb_free_urb(port_priv->write_urb);
kfree(port_priv->write_buffer);
kfree(port_priv);
return 0;