diff -c -r1.2 -r1.4
*** usb.c	2001/05/18 02:58:50	1.2
--- usb.c	2001/05/25 21:15:15	1.4
**************
*** 1787,1799 ****
  
  int usb_get_protocol(struct usb_device *dev, int ifnum)
  {
  	unsigned char type;
  	int ret;
  
  	if ((ret = usb_control_msg(dev, usb_rcvctrlpipe(dev, 0),
  	    USB_REQ_GET_PROTOCOL, USB_DIR_IN | USB_TYPE_CLASS | USB_RECIP_INTERFACE,
! 	    0, ifnum, &type, 1, HZ * GET_TIMEOUT)) < 0)
  		return ret;
  
  	return type;
  }
--- 1787,1811 ----
  
  int usb_get_protocol(struct usb_device *dev, int ifnum)
  {
+ 	unsigned char *buffer;
  	unsigned char type;
  	int ret;
  
+ 	buffer = kmalloc(1, GFP_KERNEL);
+ 	if (!buffer) {
+ 		err("unable to allocate memory for configuration descriptors");
+ 		return -ENOMEM;
+ 	}
+ 
  	if ((ret = usb_control_msg(dev, usb_rcvctrlpipe(dev, 0),
  	    USB_REQ_GET_PROTOCOL, USB_DIR_IN | USB_TYPE_CLASS | USB_RECIP_INTERFACE,
! 	    0, ifnum, buffer, 1, HZ * GET_TIMEOUT)) < 0) {
! 		kfree(buffer);
  		return ret;
+ 	}
+ 
+ 	type = *buffer;
+ 	kfree(buffer);
  
  	return type;
  }
***************
*** 1849,1854 ****
--- 1861,1867 ----
  {
  	int result;
  	__u16 status;
+ 	unsigned char *buffer;
  	int endp=usb_pipeendpoint(pipe)|(usb_pipein(pipe)<<7);
  
  /*
***************
*** 1863,1871 ****
  	if (result < 0)
  		return result;
  
  	result = usb_control_msg(dev, usb_rcvctrlpipe(dev, 0),
  		USB_REQ_GET_STATUS, USB_DIR_IN | USB_RECIP_ENDPOINT, 0, endp,
! 		&status, sizeof(status), HZ * SET_TIMEOUT);
  	if (result < 0)
  		return result;
  
--- 1876,1894 ----
  	if (result < 0)
  		return result;
  
+ 	buffer = kmalloc(sizeof(status), GFP_KERNEL);
+         if (!buffer) {
+                 err("unable to allocate memory for configuration descriptors");
+                 return -ENOMEM;
+         }
+ 
  	result = usb_control_msg(dev, usb_rcvctrlpipe(dev, 0),
  		USB_REQ_GET_STATUS, USB_DIR_IN | USB_RECIP_ENDPOINT, 0, endp,
! 		buffer, sizeof(status), HZ * SET_TIMEOUT);
! 
! 	memcpy(&status,buffer,sizeof(status));
! 	kfree(buffer);
! 
  	if (result < 0)
  		return result;
  
***************
*** 1950,1959 ****
  {
  	int result;
  	unsigned int cfgno, length;
! 	unsigned char buffer[8];
  	unsigned char *bigbuffer;
! 	struct usb_config_descriptor *desc =
! 		(struct usb_config_descriptor *)buffer;
  
  	if (dev->descriptor.bNumConfigurations > USB_MAXCONFIG) {
  		warn("too many configurations");
--- 1973,1981 ----
  {
  	int result;
  	unsigned int cfgno, length;
! 	unsigned char *buffer;
  	unsigned char *bigbuffer;
!  	struct usb_config_descriptor *desc;
  
  	if (dev->descriptor.bNumConfigurations > USB_MAXCONFIG) {
  		warn("too many configurations");
***************
*** 1982,1987 ****
--- 2004,2016 ----
  		return -ENOMEM;
  	}
  
+ 	buffer = kmalloc(8, GFP_KERNEL);
+ 	if (!buffer) {
+ 		err("unable to allocate memory for configuration descriptors");
+                 return -ENOMEM;
+ 	}
+ 	desc = (struct usb_config_descriptor *)buffer;
+ 
  	for (cfgno = 0; cfgno < dev->descriptor.bNumConfigurations; cfgno++) {
  		/* We grab the first 8 bytes so we know how long the whole */
  		/*  configuration is */
***************
*** 2032,2039 ****
--- 2061,2070 ----
  		}
  	}
  
+ 	kfree(buffer);
  	return 0;
  err:
+ 	kfree(buffer);
  	dev->descriptor.bNumConfigurations = cfgno;
  	return result;
  }
iff -c -r1.2 -r1.3
*** pegasus.c	2001/05/18 02:58:50	1.2
--- pegasus.c	2001/05/25 05:35:07	1.3
***************
*** 124,131 ****
--- 124,139 ----
  static int get_registers(pegasus_t *pegasus, __u16 indx, __u16 size, void *data)
  {
  	int	ret;
+ 	unsigned char *buffer;
  	DECLARE_WAITQUEUE(wait, current);
  
+ 	buffer = kmalloc(size,GFP_KERNEL);
+ 	if (!buffer) {
+                 err("unable to allocate memory for configuration descriptors");
+                 return 0;
+         }
+ 	memcpy(buffer,data,size);
+ 	
  	while ( pegasus->flags & ETH_REGS_CHANGED ) {
  		pegasus->flags |= CTRL_URB_SLEEP;
  		interruptible_sleep_on( &pegasus->ctrl_wait );
***************
*** 140,146 ****
  	FILL_CONTROL_URB( &pegasus->ctrl_urb, pegasus->usb,
  			  usb_rcvctrlpipe(pegasus->usb,0),
  			  (char *)&pegasus->dr,
! 			  data, size, ctrl_callback, pegasus );
  
  	add_wait_queue( &pegasus->ctrl_wait, &wait );
  	set_current_state( TASK_INTERRUPTIBLE );
--- 148,154 ----
  	FILL_CONTROL_URB( &pegasus->ctrl_urb, pegasus->usb,
  			  usb_rcvctrlpipe(pegasus->usb,0),
  			  (char *)&pegasus->dr,
! 			  buffer, size, ctrl_callback, pegasus );
  
  	add_wait_queue( &pegasus->ctrl_wait, &wait );
  	set_current_state( TASK_INTERRUPTIBLE );
***************
*** 154,159 ****
--- 162,169 ----
  	schedule();
  	remove_wait_queue( &pegasus->ctrl_wait, &wait );
  out:
+ 	memcpy(data,buffer,size);
+ 	kfree(buffer);
  	return	ret;
  }
  
***************
*** 161,168 ****
--- 171,186 ----
  static int set_registers(pegasus_t *pegasus, __u16 indx, __u16 size, void *data)
  {
  	int	ret;
+         unsigned char *buffer;
  	DECLARE_WAITQUEUE(wait, current);
  
+         buffer = kmalloc(size,GFP_KERNEL);
+         if (!buffer) {
+                 err("unable to allocate memory for configuration descriptors");
+                 return 0;
+         }
+         memcpy(buffer,data,size);
+ 
  	while ( pegasus->flags & ETH_REGS_CHANGED ) {
  		pegasus->flags |= CTRL_URB_SLEEP ;
  		interruptible_sleep_on( &pegasus->ctrl_wait );
***************
*** 177,183 ****
  	FILL_CONTROL_URB( &pegasus->ctrl_urb, pegasus->usb,
  			  usb_sndctrlpipe(pegasus->usb,0),
  			  (char *)&pegasus->dr,
! 			  data, size, ctrl_callback, pegasus );
  			  
  	add_wait_queue( &pegasus->ctrl_wait, &wait );
  	set_current_state( TASK_INTERRUPTIBLE );
--- 195,201 ----
  	FILL_CONTROL_URB( &pegasus->ctrl_urb, pegasus->usb,
  			  usb_sndctrlpipe(pegasus->usb,0),
  			  (char *)&pegasus->dr,
! 			  buffer, size, ctrl_callback, pegasus );
  			  
  	add_wait_queue( &pegasus->ctrl_wait, &wait );
  	set_current_state( TASK_INTERRUPTIBLE );
***************
*** 185,196 ****
--- 203,216 ----
  
  	if ( (ret = usb_submit_urb( &pegasus->ctrl_urb )) ) {
  		err( __FUNCTION__ " BAD CTRL %d", ret);
+ 		kfree(buffer);
  		return	ret;
  	}
  
  	schedule();
  	remove_wait_queue( &pegasus->ctrl_wait, &wait );
  
+ 	kfree(buffer);
  	return	ret;
  }
  
***************
*** 198,206 ****
--- 218,234 ----
  static int set_register( pegasus_t *pegasus, __u16 indx, __u8 data )
  {
  	int	ret;
+         unsigned char *buffer;
  	__u16 dat = data;
  	DECLARE_WAITQUEUE(wait, current);
  	
+         buffer = kmalloc(1,GFP_KERNEL);
+         if (!buffer) {
+                 err("unable to allocate memory for configuration descriptors");
+                 return 0;
+         }
+         memcpy(buffer,&data,1);
+ 
  	while ( pegasus->flags & ETH_REGS_CHANGED ) {
  		pegasus->flags |= CTRL_URB_SLEEP;
  		interruptible_sleep_on( &pegasus->ctrl_wait );
***************
*** 215,221 ****
  	FILL_CONTROL_URB( &pegasus->ctrl_urb, pegasus->usb,
  			  usb_sndctrlpipe(pegasus->usb,0),
  			  (char *)&pegasus->dr,
! 			  &data, 1, ctrl_callback, pegasus );
  
  	add_wait_queue( &pegasus->ctrl_wait, &wait );
  	set_current_state( TASK_INTERRUPTIBLE );
--- 243,249 ----
  	FILL_CONTROL_URB( &pegasus->ctrl_urb, pegasus->usb,
  			  usb_sndctrlpipe(pegasus->usb,0),
  			  (char *)&pegasus->dr,
! 			  buffer, 1, ctrl_callback, pegasus );
  
  	add_wait_queue( &pegasus->ctrl_wait, &wait );
  	set_current_state( TASK_INTERRUPTIBLE );
***************
*** 223,234 ****
--- 251,264 ----
  
  	if ( (ret = usb_submit_urb( &pegasus->ctrl_urb )) ) {
  		err( __FUNCTION__ " BAD CTRL %d", ret);
+ 		kfree(buffer);
  		return	ret;
  	}
  
  	schedule();
  	remove_wait_queue( &pegasus->ctrl_wait, &wait );
  
+ 	kfree(buffer);
  	return	ret;
  }