From: Dave Airlie <airl...@redhat.com>

Thou shall not send control msg from the stack,
does that mean I can send it from the RO memory area?

and it looks like the answer is no, so here's
v2 which kmemdups.

Reported-by: poma
Signed-off-by: Dave Airlie <airlied at redhat.com>
---
 drivers/gpu/drm/udl/udl_main.c | 16 +++++++++++-----
 1 file changed, 11 insertions(+), 5 deletions(-)

diff --git a/drivers/gpu/drm/udl/udl_main.c b/drivers/gpu/drm/udl/udl_main.c
index 29f0207..873f010 100644
--- a/drivers/gpu/drm/udl/udl_main.c
+++ b/drivers/gpu/drm/udl/udl_main.c
@@ -98,17 +98,23 @@ static int udl_parse_vendor_descriptor(struct drm_device 
*dev,
 static int udl_select_std_channel(struct udl_device *udl)
 {
        int ret;
-       u8 set_def_chn[] = {0x57, 0xCD, 0xDC, 0xA7,
-                           0x1C, 0x88, 0x5E, 0x15,
-                           0x60, 0xFE, 0xC6, 0x97,
-                           0x16, 0x3D, 0x47, 0xF2};
+       static const u8 set_def_chn[] = {0x57, 0xCD, 0xDC, 0xA7,
+                                        0x1C, 0x88, 0x5E, 0x15,
+                                        0x60, 0xFE, 0xC6, 0x97,
+                                        0x16, 0x3D, 0x47, 0xF2};
+       void *sendbuf;
+
+       sendbuf = kmemdup(set_def_chn, sizeof(set_def_chn), GFP_KERNEL);
+       if (!sendbuf)
+               return -ENOMEM;

        ret = usb_control_msg(udl->udev,
                              usb_sndctrlpipe(udl->udev, 0),
                              NR_USB_REQUEST_CHANNEL,
                              (USB_DIR_OUT | USB_TYPE_VENDOR), 0, 0,
-                             set_def_chn, sizeof(set_def_chn),
+                             sendbuf, sizeof(set_def_chn),
                              USB_CTRL_SET_TIMEOUT);
+       kfree(sendbuf);
        return ret < 0 ? ret : 0;
 }

-- 
2.5.5

Reply via email to