[stable] patch "ums_realtek: do not use stack memory for DMA" added to usb tree

[gregkh]

This is a note to let you know that I've just added the patch titled

    ums_realtek: do not use stack memory for DMA

to my usb git tree which can be found at
    git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb-2.6.git
in the usb-next branch.

The patch will show up in the next release of the linux-next tree
(usually sometime within the next 24 hours during the week.)

The patch will also will be merged in the next major kernel release
during the merge window.

If you have any questions about this process, please let me know.


>From 065e60964e293227e4feb0c1f7e27e609316ed9a Mon Sep 17 00:00:00 2001
From: Adam Cozzette <acozze...@cs.hmc.edu>
Date: Wed, 24 Aug 2011 12:22:37 -0600
Subject: ums_realtek: do not use stack memory for DMA

This patch changes rts51x_read_mem, rts51x_write_mem, and rts51x_read_status to
allocate temporary buffers with kmalloc. This way stack addresses are not used
for DMA when these functions call rts51x_bulk_transport.

Signed-off-by: Adam Cozzette <acozze...@cs.hmc.edu>
Cc: stable <sta...@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gre...@suse.de>
---
 drivers/usb/storage/realtek_cr.c |   35 ++++++++++++++++++++++++++++++-----
 1 files changed, 30 insertions(+), 5 deletions(-)

diff --git a/drivers/usb/storage/realtek_cr.c b/drivers/usb/storage/realtek_cr.c
index 34adc4b..232167a 100644
--- a/drivers/usb/storage/realtek_cr.c
+++ b/drivers/usb/storage/realtek_cr.c
@@ -320,6 +320,11 @@ static int rts51x_read_mem(struct us_data *us, u16 addr, 
u8 *data, u16 len)
 {
        int retval;
        u8 cmnd[12] = { 0 };
+       u8 *buf;
+
+       buf = kmalloc(len, GFP_NOIO);
+       if (buf == NULL)
+               return USB_STOR_TRANSPORT_ERROR;
 
        US_DEBUGP("%s, addr = 0x%x, len = %d\n", __func__, addr, len);
 
@@ -331,10 +336,14 @@ static int rts51x_read_mem(struct us_data *us, u16 addr, 
u8 *data, u16 len)
        cmnd[5] = (u8) len;
 
        retval = rts51x_bulk_transport(us, 0, cmnd, 12,
-                                      data, len, DMA_FROM_DEVICE, NULL);
-       if (retval != USB_STOR_TRANSPORT_GOOD)
+                                      buf, len, DMA_FROM_DEVICE, NULL);
+       if (retval != USB_STOR_TRANSPORT_GOOD) {
+               kfree(buf);
                return -EIO;
+       }
 
+       memcpy(data, buf, len);
+       kfree(buf);
        return 0;
 }
 
@@ -342,6 +351,12 @@ static int rts51x_write_mem(struct us_data *us, u16 addr, 
u8 *data, u16 len)
 {
        int retval;
        u8 cmnd[12] = { 0 };
+       u8 *buf;
+
+       buf = kmalloc(len, GFP_NOIO);
+       if (buf == NULL)
+               return USB_STOR_TRANSPORT_ERROR;
+       memcpy(buf, data, len);
 
        US_DEBUGP("%s, addr = 0x%x, len = %d\n", __func__, addr, len);
 
@@ -353,7 +368,8 @@ static int rts51x_write_mem(struct us_data *us, u16 addr, 
u8 *data, u16 len)
        cmnd[5] = (u8) len;
 
        retval = rts51x_bulk_transport(us, 0, cmnd, 12,
-                                      data, len, DMA_TO_DEVICE, NULL);
+                                      buf, len, DMA_TO_DEVICE, NULL);
+       kfree(buf);
        if (retval != USB_STOR_TRANSPORT_GOOD)
                return -EIO;
 
@@ -365,6 +381,11 @@ static int rts51x_read_status(struct us_data *us,
 {
        int retval;
        u8 cmnd[12] = { 0 };
+       u8 *buf;
+
+       buf = kmalloc(len, GFP_NOIO);
+       if (buf == NULL)
+               return USB_STOR_TRANSPORT_ERROR;
 
        US_DEBUGP("%s, lun = %d\n", __func__, lun);
 
@@ -372,10 +393,14 @@ static int rts51x_read_status(struct us_data *us,
        cmnd[1] = 0x09;
 
        retval = rts51x_bulk_transport(us, lun, cmnd, 12,
-                                      status, len, DMA_FROM_DEVICE, actlen);
-       if (retval != USB_STOR_TRANSPORT_GOOD)
+                                      buf, len, DMA_FROM_DEVICE, actlen);
+       if (retval != USB_STOR_TRANSPORT_GOOD) {
+               kfree(buf);
                return -EIO;
+       }
 
+       memcpy(status, buf, len);
+       kfree(buf);
        return 0;
 }
 
-- 
1.7.6


_______________________________________________
stable mailing list
stable@linux.kernel.org
http://linux.kernel.org/mailman/listinfo/stable