Commit 59bf5cf9 authored by Greg Kroah-Hartman's avatar Greg Kroah-Hartman

USB: isight: fix kernel bug when loading firmware

We were sending data on the stack when uploading firmware, which causes
some machines fits, and is not allowed.  Fix this by using the buffer we
already had around for this very purpose.
Reported-by: default avatarWouter M. Koolen <wmkoolen@cwi.nl>
Tested-by: default avatarWouter M. Koolen <wmkoolen@cwi.nl>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@suse.de>
parent bc677d5b
...@@ -55,8 +55,9 @@ static int isight_firmware_load(struct usb_interface *intf, ...@@ -55,8 +55,9 @@ static int isight_firmware_load(struct usb_interface *intf,
ptr = firmware->data; ptr = firmware->data;
buf[0] = 0x01;
if (usb_control_msg if (usb_control_msg
(dev, usb_sndctrlpipe(dev, 0), 0xa0, 0x40, 0xe600, 0, "\1", 1, (dev, usb_sndctrlpipe(dev, 0), 0xa0, 0x40, 0xe600, 0, buf, 1,
300) != 1) { 300) != 1) {
printk(KERN_ERR printk(KERN_ERR
"Failed to initialise isight firmware loader\n"); "Failed to initialise isight firmware loader\n");
...@@ -100,8 +101,9 @@ static int isight_firmware_load(struct usb_interface *intf, ...@@ -100,8 +101,9 @@ static int isight_firmware_load(struct usb_interface *intf,
} }
} }
buf[0] = 0x00;
if (usb_control_msg if (usb_control_msg
(dev, usb_sndctrlpipe(dev, 0), 0xa0, 0x40, 0xe600, 0, "\0", 1, (dev, usb_sndctrlpipe(dev, 0), 0xa0, 0x40, 0xe600, 0, buf, 1,
300) != 1) { 300) != 1) {
printk(KERN_ERR "isight firmware loading completion failed\n"); printk(KERN_ERR "isight firmware loading completion failed\n");
ret = -ENODEV; ret = -ENODEV;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment