On 08.11.2016 07:47, Dave Airlie wrote:
> From: Dave Airlie <airlied at redhat.com>
>
> Thou shall not send control msg from the stack,
> does that mean I can send it from the RO memory area?
>
> and it looks like the answer is no, so here's
> v2 which kmemdups.
>
> Reported-by: poma
> Signed-off-by: Dave Airlie <airlied at redhat.com>
> ---
> drivers/gpu/drm/udl/udl_main.c | 16 +++++++++++-----
> 1 file changed, 11 insertions(+), 5 deletions(-)
>
> diff --git a/drivers/gpu/drm/udl/udl_main.c b/drivers/gpu/drm/udl/udl_main.c
> index 29f0207..873f010 100644
> --- a/drivers/gpu/drm/udl/udl_main.c
> +++ b/drivers/gpu/drm/udl/udl_main.c
> @@ -98,17 +98,23 @@ static int udl_parse_vendor_descriptor(struct drm_device
> *dev,
> static int udl_select_std_channel(struct udl_device *udl)
> {
> int ret;
> - u8 set_def_chn[] = {0x57, 0xCD, 0xDC, 0xA7,
> - 0x1C, 0x88, 0x5E, 0x15,
> - 0x60, 0xFE, 0xC6, 0x97,
> - 0x16, 0x3D, 0x47, 0xF2};
> + static const u8 set_def_chn[] = {0x57, 0xCD, 0xDC, 0xA7,
> + 0x1C, 0x88, 0x5E, 0x15,
> + 0x60, 0xFE, 0xC6, 0x97,
> + 0x16, 0x3D, 0x47, 0xF2};
> + void *sendbuf;
> +
> + sendbuf = kmemdup(set_def_chn, sizeof(set_def_chn), GFP_KERNEL);
> + if (!sendbuf)
> + return -ENOMEM;
>
> ret = usb_control_msg(udl->udev,
> usb_sndctrlpipe(udl->udev, 0),
> NR_USB_REQUEST_CHANNEL,
> (USB_DIR_OUT | USB_TYPE_VENDOR), 0, 0,
> - set_def_chn, sizeof(set_def_chn),
> + sendbuf, sizeof(set_def_chn),
> USB_CTRL_SET_TIMEOUT);
> + kfree(sendbuf);
> return ret < 0 ? ret : 0;
> }
>
>
v2 is OK.
Tested-by: poma <poma at gmail.com>
