/linux_media forked from ljalves/linux_media

Permalink
Browse files

tbs-usb: Use heap buffer for USB I/O.

  • Loading branch information...
1 parent 7b1ae21 commit c96944e5b356ff950c6d3a790e27b240e334623a @crazycat69 crazycat69 committed Mar 20, 2017
View
7 drivers/media/usb/dvb-usb/tbs-qbox.c
@@ -47,19 +47,24 @@ static int tbsqboxs1_op_rw(struct usb_device *dev, u8 request, u16 value,
u16 index, u8 * data, u16 len, int flags)
{
int ret;
- u8 u8buf[len];
+ void *u8buf;
unsigned int pipe = (flags == TBSQBOX_READ_MSG) ?
usb_rcvctrlpipe(dev, 0) : usb_sndctrlpipe(dev, 0);
u8 request_type = (flags == TBSQBOX_READ_MSG) ? USB_DIR_IN : USB_DIR_OUT;
+ u8buf = kmalloc(len, GFP_KERNEL);
+ if (!u8buf)
+ return -ENOMEM;
+
if (flags == TBSQBOX_WRITE_MSG)
memcpy(u8buf, data, len);
ret = usb_control_msg(dev, pipe, request, request_type | USB_TYPE_VENDOR,
value, index , u8buf, len, 2000);
if (flags == TBSQBOX_READ_MSG)
memcpy(data, u8buf, len);
+ kfree(u8buf);
return ret;
}
View
7 drivers/media/usb/dvb-usb/tbs-qbox2.c
@@ -48,19 +48,24 @@ static int tbsqbox2_op_rw(struct usb_device *dev, u8 request, u16 value,
u16 index, u8 * data, u16 len, int flags)
{
int ret;
- u8 u8buf[len];
+ void *u8buf;
unsigned int pipe = (flags == TBSQBOX_READ_MSG) ?
usb_rcvctrlpipe(dev, 0) : usb_sndctrlpipe(dev, 0);
u8 request_type = (flags == TBSQBOX_READ_MSG) ? USB_DIR_IN : USB_DIR_OUT;
+ u8buf = kmalloc(len, GFP_KERNEL);
+ if (!u8buf)
+ return -ENOMEM;
+
if (flags == TBSQBOX_WRITE_MSG)
memcpy(u8buf, data, len);
ret = usb_control_msg(dev, pipe, request, request_type | USB_TYPE_VENDOR,
value, index , u8buf, len, 2000);
if (flags == TBSQBOX_READ_MSG)
memcpy(data, u8buf, len);
+ kfree(u8buf);
return ret;
}
View
9 drivers/media/usb/dvb-usb/tbs-qbox22.c
@@ -54,19 +54,24 @@ static int tbsqbox22_op_rw(struct usb_device *dev, u8 request, u16 value,
u16 index, u8 * data, u16 len, int flags)
{
int ret;
- u8 u8buf[len];
+ void *u8buf;
unsigned int pipe = (flags == TBSQBOX_READ_MSG) ?
usb_rcvctrlpipe(dev, 0) : usb_sndctrlpipe(dev, 0);
u8 request_type = (flags == TBSQBOX_READ_MSG) ? USB_DIR_IN : USB_DIR_OUT;
+ u8buf = kmalloc(len, GFP_KERNEL);
+ if (!u8buf)
+ return -ENOMEM;
+
if (flags == TBSQBOX_WRITE_MSG)
memcpy(u8buf, data, len);
ret = usb_control_msg(dev, pipe, request, request_type | USB_TYPE_VENDOR,
- value, index, u8buf, len, 2000);
+ value, index , u8buf, len, 2000);
if (flags == TBSQBOX_READ_MSG)
memcpy(data, u8buf, len);
+ kfree(u8buf);
return ret;
}
View
16 drivers/media/usb/dvb-usb/tbs-qbox2ci.c
@@ -50,20 +50,24 @@ static int tbsqbox2ci_op_rw(struct usb_device *dev, u8 request, u16 value,
u16 index, u8 * data, u16 len, int flags)
{
int ret;
- u8 u8buf[len];
+ void *u8buf;
unsigned int pipe = (flags == TBSQBOX_READ_MSG) ?
- usb_rcvctrlpipe(dev, 0) : usb_sndctrlpipe(dev, 0);
- u8 request_type = (flags == TBSQBOX_READ_MSG) ? USB_DIR_IN :
- USB_DIR_OUT;
+ usb_rcvctrlpipe(dev, 0) : usb_sndctrlpipe(dev, 0);
+ u8 request_type = (flags == TBSQBOX_READ_MSG) ? USB_DIR_IN : USB_DIR_OUT;
+
+ u8buf = kmalloc(len, GFP_KERNEL);
+ if (!u8buf)
+ return -ENOMEM;
if (flags == TBSQBOX_WRITE_MSG)
memcpy(u8buf, data, len);
- ret = usb_control_msg(dev, pipe, request, request_type |
- USB_TYPE_VENDOR, value, index , u8buf, len, 2000);
+ ret = usb_control_msg(dev, pipe, request, request_type | USB_TYPE_VENDOR,
+ value, index , u8buf, len, 2000);
if (flags == TBSQBOX_READ_MSG)
memcpy(data, u8buf, len);
+ kfree(u8buf);
return ret;
}
View
9 drivers/media/usb/dvb-usb/tbs-qboxs2.c
@@ -50,19 +50,24 @@ static int tbsqboxs2_op_rw(struct usb_device *dev, u8 request, u16 value,
u16 index, u8 * data, u16 len, int flags)
{
int ret;
- u8 u8buf[len];
+ void *u8buf;
unsigned int pipe = (flags == TBSQBOX_READ_MSG) ?
usb_rcvctrlpipe(dev, 0) : usb_sndctrlpipe(dev, 0);
u8 request_type = (flags == TBSQBOX_READ_MSG) ? USB_DIR_IN : USB_DIR_OUT;
+ u8buf = kmalloc(len, GFP_KERNEL);
+ if (!u8buf)
+ return -ENOMEM;
+
if (flags == TBSQBOX_WRITE_MSG)
memcpy(u8buf, data, len);
ret = usb_control_msg(dev, pipe, request, request_type | USB_TYPE_VENDOR,
- value, index, u8buf, len, 2000);
+ value, index , u8buf, len, 2000);
if (flags == TBSQBOX_READ_MSG)
memcpy(data, u8buf, len);
+ kfree(u8buf);
return ret;
}
View
13 drivers/media/usb/dvb-usb/tbs5220.c
@@ -37,20 +37,23 @@ static int tbs5220_op_rw(struct usb_device *dev, u8 request, u16 value,
u16 index, u8 * data, u16 len, int flags)
{
int ret;
- u8 u8buf[len];
+ void *u8buf;
unsigned int pipe = (flags == TBS5220_READ_MSG) ?
usb_rcvctrlpipe(dev, 0) : usb_sndctrlpipe(dev, 0);
- u8 request_type = (flags == TBS5220_READ_MSG) ? USB_DIR_IN :
- USB_DIR_OUT;
+ u8 request_type = (flags == TBS5220_READ_MSG) ? USB_DIR_IN : USB_DIR_OUT;
+ u8buf = kmalloc(len, GFP_KERNEL);
+ if (!u8buf)
+ return -ENOMEM;
if (flags == TBS5220_WRITE_MSG)
memcpy(u8buf, data, len);
- ret = usb_control_msg(dev, pipe, request, request_type |
- USB_TYPE_VENDOR, value, index , u8buf, len, 2000);
+ ret = usb_control_msg(dev, pipe, request, request_type | USB_TYPE_VENDOR,
+ value, index , u8buf, len, 2000);
if (flags == TBS5220_READ_MSG)
memcpy(data, u8buf, len);
+ kfree(u8buf);
return ret;
}
View
13 drivers/media/usb/dvb-usb/tbs5520.c
@@ -40,20 +40,23 @@ static int tbs5520_op_rw(struct usb_device *dev, u8 request, u16 value,
u16 index, u8 *data, u16 len, int flags)
{
int ret;
- u8 u8buf[len];
+ void *u8buf;
unsigned int pipe = (flags == tbs5520_READ_MSG) ?
usb_rcvctrlpipe(dev, 0) : usb_sndctrlpipe(dev, 0);
- u8 request_type = (flags == tbs5520_READ_MSG) ? USB_DIR_IN :
- USB_DIR_OUT;
+ u8 request_type = (flags == tbs5520_READ_MSG) ? USB_DIR_IN : USB_DIR_OUT;
+ u8buf = kmalloc(len, GFP_KERNEL);
+ if (!u8buf)
+ return -ENOMEM;
if (flags == tbs5520_WRITE_MSG)
memcpy(u8buf, data, len);
- ret = usb_control_msg(dev, pipe, request, request_type |
- USB_TYPE_VENDOR, value, index , u8buf, len, 2000);
+ ret = usb_control_msg(dev, pipe, request, request_type | USB_TYPE_VENDOR,
+ value, index , u8buf, len, 2000);
if (flags == tbs5520_READ_MSG)
memcpy(data, u8buf, len);
+ kfree(u8buf);
return ret;
}
View
13 drivers/media/usb/dvb-usb/tbs5520se.c
@@ -45,20 +45,23 @@ static int tbs5520se_op_rw(struct usb_device *dev, u8 request, u16 value,
u16 index, u8 * data, u16 len, int flags)
{
int ret;
- u8 u8buf[len];
+ void *u8buf;
unsigned int pipe = (flags == TBS5520se_READ_MSG) ?
usb_rcvctrlpipe(dev, 0) : usb_sndctrlpipe(dev, 0);
- u8 request_type = (flags == TBS5520se_READ_MSG) ? USB_DIR_IN :
- USB_DIR_OUT;
+ u8 request_type = (flags == TBS5520se_READ_MSG) ? USB_DIR_IN : USB_DIR_OUT;
+ u8buf = kmalloc(len, GFP_KERNEL);
+ if (!u8buf)
+ return -ENOMEM;
if (flags == TBS5520se_WRITE_MSG)
memcpy(u8buf, data, len);
- ret = usb_control_msg(dev, pipe, request, request_type |
- USB_TYPE_VENDOR, value, index , u8buf, len, 2000);
+ ret = usb_control_msg(dev, pipe, request, request_type | USB_TYPE_VENDOR,
+ value, index , u8buf, len, 2000);
if (flags == TBS5520se_READ_MSG)
memcpy(data, u8buf, len);
+ kfree(u8buf);
return ret;
}
View
13 drivers/media/usb/dvb-usb/tbs5880.c
@@ -48,20 +48,23 @@ static int tbs5880_op_rw(struct usb_device *dev, u8 request, u16 value,
u16 index, u8 * data, u16 len, int flags)
{
int ret;
- u8 u8buf[len];
+ void *u8buf;
unsigned int pipe = (flags == TBS5880_READ_MSG) ?
usb_rcvctrlpipe(dev, 0) : usb_sndctrlpipe(dev, 0);
- u8 request_type = (flags == TBS5880_READ_MSG) ? USB_DIR_IN :
- USB_DIR_OUT;
+ u8 request_type = (flags == TBS5880_READ_MSG) ? USB_DIR_IN : USB_DIR_OUT;
+ u8buf = kmalloc(len, GFP_KERNEL);
+ if (!u8buf)
+ return -ENOMEM;
if (flags == TBS5880_WRITE_MSG)
memcpy(u8buf, data, len);
- ret = usb_control_msg(dev, pipe, request, request_type |
- USB_TYPE_VENDOR, value, index , u8buf, len, 2000);
+ ret = usb_control_msg(dev, pipe, request, request_type | USB_TYPE_VENDOR,
+ value, index , u8buf, len, 2000);
if (flags == TBS5880_READ_MSG)
memcpy(data, u8buf, len);
+ kfree(u8buf);
return ret;
}
View
13 drivers/media/usb/dvb-usb/tbs5881.c
@@ -46,20 +46,23 @@ static int tbs5881_op_rw(struct usb_device *dev, u8 request, u16 value,
u16 index, u8 * data, u16 len, int flags)
{
int ret;
- u8 u8buf[len];
+ void *u8buf;
unsigned int pipe = (flags == TBS5881_READ_MSG) ?
usb_rcvctrlpipe(dev, 0) : usb_sndctrlpipe(dev, 0);
- u8 request_type = (flags == TBS5881_READ_MSG) ? USB_DIR_IN :
- USB_DIR_OUT;
+ u8 request_type = (flags == TBS5881_READ_MSG) ? USB_DIR_IN : USB_DIR_OUT;
+ u8buf = kmalloc(len, GFP_KERNEL);
+ if (!u8buf)
+ return -ENOMEM;
if (flags == TBS5881_WRITE_MSG)
memcpy(u8buf, data, len);
- ret = usb_control_msg(dev, pipe, request, request_type |
- USB_TYPE_VENDOR, value, index , u8buf, len, 2000);
+ ret = usb_control_msg(dev, pipe, request, request_type | USB_TYPE_VENDOR,
+ value, index , u8buf, len, 2000);
if (flags == TBS5881_READ_MSG)
memcpy(data, u8buf, len);
+ kfree(u8buf);
return ret;
}
View
10 drivers/media/usb/dvb-usb/tbs5922se.c
@@ -54,19 +54,23 @@ static int tbs5922se_op_rw(struct usb_device *dev, u8 request, u16 value,
u16 index, u8 * data, u16 len, int flags)
{
int ret;
- u8 u8buf[len];
+ void *u8buf;
unsigned int pipe = (flags == TBS5922SE_READ_MSG) ?
- usb_rcvctrlpipe(dev, 0) : usb_sndctrlpipe(dev, 0);
+ usb_rcvctrlpipe(dev, 0) : usb_sndctrlpipe(dev, 0);
u8 request_type = (flags == TBS5922SE_READ_MSG) ? USB_DIR_IN : USB_DIR_OUT;
+ u8buf = kmalloc(len, GFP_KERNEL);
+ if (!u8buf)
+ return -ENOMEM;
if (flags == TBS5922SE_WRITE_MSG)
memcpy(u8buf, data, len);
ret = usb_control_msg(dev, pipe, request, request_type | USB_TYPE_VENDOR,
- value, index, u8buf, len, 2000);
+ value, index , u8buf, len, 2000);
if (flags == TBS5922SE_READ_MSG)
memcpy(data, u8buf, len);
+ kfree(u8buf);
return ret;
}
View
8 drivers/media/usb/dvb-usb/tbs5925.c
@@ -45,11 +45,14 @@ static int tbs5925_op_rw(struct usb_device *dev, u8 request, u16 value,
u16 index, u8 * data, u16 len, int flags)
{
int ret;
- u8 u8buf[len];
+ void *u8buf;
unsigned int pipe = (flags == TBS5925_READ_MSG) ?
- usb_rcvctrlpipe(dev, 0) : usb_sndctrlpipe(dev, 0);
+ usb_rcvctrlpipe(dev, 0) : usb_sndctrlpipe(dev, 0);
u8 request_type = (flags == TBS5925_READ_MSG) ? USB_DIR_IN : USB_DIR_OUT;
+ u8buf = kmalloc(len, GFP_KERNEL);
+ if (!u8buf)
+ return -ENOMEM;
if (flags == TBS5925_WRITE_MSG)
memcpy(u8buf, data, len);
@@ -58,6 +61,7 @@ static int tbs5925_op_rw(struct usb_device *dev, u8 request, u16 value,
if (flags == TBS5925_READ_MSG)
memcpy(data, u8buf, len);
+ kfree(u8buf);
return ret;
}
View
8 drivers/media/usb/dvb-usb/tbs5927.c
@@ -43,11 +43,14 @@ static int tbs5927_op_rw(struct usb_device *dev, u8 request, u16 value,
u16 index, u8 * data, u16 len, int flags)
{
int ret;
- u8 u8buf[len];
+ void *u8buf;
unsigned int pipe = (flags == TBS5927_READ_MSG) ?
- usb_rcvctrlpipe(dev, 0) : usb_sndctrlpipe(dev, 0);
+ usb_rcvctrlpipe(dev, 0) : usb_sndctrlpipe(dev, 0);
u8 request_type = (flags == TBS5927_READ_MSG) ? USB_DIR_IN : USB_DIR_OUT;
+ u8buf = kmalloc(len, GFP_KERNEL);
+ if (!u8buf)
+ return -ENOMEM;
if (flags == TBS5927_WRITE_MSG)
memcpy(u8buf, data, len);
@@ -56,6 +59,7 @@ static int tbs5927_op_rw(struct usb_device *dev, u8 request, u16 value,
if (flags == TBS5927_READ_MSG)
memcpy(data, u8buf, len);
+ kfree(u8buf);
return ret;
}

0 comments on commit c96944e

Please sign in to comment.