Commit 6485381c authored by Stefan Brüns's avatar Stefan Brüns Committed by Greg Kroah-Hartman

dvb-usb-firmware: don't do DMA on stack

commit 67b0503d upstream.

The buffer allocation for the firmware data was changed in
commit 43fab979 ("[media] dvb-usb: don't use stack for firmware load")
but the same applies for the reset value.

Fixes: 43fab979 ("[media] dvb-usb: don't use stack for firmware load")
Signed-off-by: default avatarStefan Brüns <stefan.bruens@rwth-aachen.de>
Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@s-opensource.com>
Cc: Ben Hutchings <ben@decadent.org.uk>
Cc: Brad Spengler <spender@grsecurity.net>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent ab9ea4dc
...@@ -36,16 +36,18 @@ static int usb_cypress_writemem(struct usb_device *udev,u16 addr,u8 *data, u8 le ...@@ -36,16 +36,18 @@ static int usb_cypress_writemem(struct usb_device *udev,u16 addr,u8 *data, u8 le
int usb_cypress_load_firmware(struct usb_device *udev, const struct firmware *fw, int type) int usb_cypress_load_firmware(struct usb_device *udev, const struct firmware *fw, int type)
{ {
struct hexline *hx; struct hexline *hx;
u8 reset; u8 *buf;
int ret,pos=0; int ret, pos = 0;
u16 cpu_cs_register = cypress[type].cpu_cs_register;
hx = kmalloc(sizeof(*hx), GFP_KERNEL); buf = kmalloc(sizeof(*hx), GFP_KERNEL);
if (!hx) if (!buf)
return -ENOMEM; return -ENOMEM;
hx = (struct hexline *)buf;
/* stop the CPU */ /* stop the CPU */
reset = 1; buf[0] = 1;
if ((ret = usb_cypress_writemem(udev,cypress[type].cpu_cs_register,&reset,1)) != 1) if (usb_cypress_writemem(udev, cpu_cs_register, buf, 1) != 1)
err("could not stop the USB controller CPU."); err("could not stop the USB controller CPU.");
while ((ret = dvb_usb_get_hexline(fw, hx, &pos)) > 0) { while ((ret = dvb_usb_get_hexline(fw, hx, &pos)) > 0) {
...@@ -62,21 +64,21 @@ int usb_cypress_load_firmware(struct usb_device *udev, const struct firmware *fw ...@@ -62,21 +64,21 @@ int usb_cypress_load_firmware(struct usb_device *udev, const struct firmware *fw
} }
if (ret < 0) { if (ret < 0) {
err("firmware download failed at %d with %d",pos,ret); err("firmware download failed at %d with %d",pos,ret);
kfree(hx); kfree(buf);
return ret; return ret;
} }
if (ret == 0) { if (ret == 0) {
/* restart the CPU */ /* restart the CPU */
reset = 0; buf[0] = 0;
if (ret || usb_cypress_writemem(udev,cypress[type].cpu_cs_register,&reset,1) != 1) { if (usb_cypress_writemem(udev, cpu_cs_register, buf, 1) != 1) {
err("could not restart the USB controller CPU."); err("could not restart the USB controller CPU.");
ret = -EINVAL; ret = -EINVAL;
} }
} else } else
ret = -EIO; ret = -EIO;
kfree(hx); kfree(buf);
return ret; return ret;
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment