From: Mauro Carvalho Chehab <mche...@osg.samsung.com>

The USB control messages require DMA to work. We cannot pass
a stack-allocated buffer, as it is not warranted that the
stack would be into a DMA enabled area.

Signed-off-by: Mauro Carvalho Chehab <mche...@osg.samsung.com>
Signed-off-by: Mauro Carvalho Chehab <mche...@s-opensource.com>
---
 drivers/media/usb/cpia2/cpia2_usb.c | 32 +++++++++++++++++++++++++++++---
 1 file changed, 29 insertions(+), 3 deletions(-)

diff --git a/drivers/media/usb/cpia2/cpia2_usb.c 
b/drivers/media/usb/cpia2/cpia2_usb.c
index 13620cdf0599..417d683b237d 100644
--- a/drivers/media/usb/cpia2/cpia2_usb.c
+++ b/drivers/media/usb/cpia2/cpia2_usb.c
@@ -545,10 +545,19 @@ static void free_sbufs(struct camera_data *cam)
 static int write_packet(struct usb_device *udev,
                        u8 request, u8 * registers, u16 start, size_t size)
 {
+       unsigned char *buf;
+       int ret;
+
        if (!registers || size <= 0)
                return -EINVAL;
 
-       return usb_control_msg(udev,
+       buf = kmalloc(size, GFP_KERNEL);
+       if (!buf)
+               return -ENOMEM;
+
+       memcpy(buf, registers, size);
+
+       ret = usb_control_msg(udev,
                               usb_sndctrlpipe(udev, 0),
                               request,
                               USB_TYPE_VENDOR | USB_RECIP_DEVICE,
@@ -557,6 +566,9 @@ static int write_packet(struct usb_device *udev,
                               registers,       /* buffer */
                               size,
                               HZ);
+
+       kfree(buf);
+       return ret;
 }
 
 /****************************************************************************
@@ -567,18 +579,32 @@ static int write_packet(struct usb_device *udev,
 static int read_packet(struct usb_device *udev,
                       u8 request, u8 * registers, u16 start, size_t size)
 {
+       unsigned char *buf;
+       int ret;
+
        if (!registers || size <= 0)
                return -EINVAL;
 
-       return usb_control_msg(udev,
+       buf = kmalloc(size, GFP_KERNEL);
+       if (!buf)
+               return -ENOMEM;
+
+       ret = usb_control_msg(udev,
                               usb_rcvctrlpipe(udev, 0),
                               request,
                               USB_DIR_IN|USB_TYPE_VENDOR|USB_RECIP_DEVICE,
                               start,   /* value */
                               0,       /* index */
-                              registers,       /* buffer */
+                              buf,     /* buffer */
                               size,
                               HZ);
+
+       if (ret >= 0)
+               memcpy (registers, buf, size);
+
+       kfree(buf);
+
+       return ret;
 }
 
 /******************************************************************************
-- 
2.7.4


Reply via email to