video: fbdev: udlfb: Fix buffer on stack

[ Upstream commit 45f580c42e5c125d55dbd8099750a1998de3d917 ]

Allocate buffers on HEAP instead of STACK for local array
that is to be sent using usb_control_msg().

Signed-off-by: Maksim Salau <maksim.salau@gmail.com>
Cc: Bernie Thompson <bernie@plugable.com>
Cc: Geert Uytterhoeven <geert@linux-m68k.org>
Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/video/fbdev/udlfb.c b/drivers/video/fbdev/udlfb.c
index 53326ba..2add8de 100644 (file)
--- a/drivers/video/fbdev/udlfb.c
+++ b/drivers/video/fbdev/udlfb.c
@@ -1487,15 +1487,25 @@ static struct device_attribute fb_device_attrs[] = {
 static int dlfb_select_std_channel(struct dlfb_data *dev)
 {
        int ret;
-       u8 set_def_chn[] = {       0x57, 0xCD, 0xDC, 0xA7,
+       void *buf;
+       static const u8 set_def_chn[] = {
+                               0x57, 0xCD, 0xDC, 0xA7,
                                0x1C, 0x88, 0x5E, 0x15,
                                0x60, 0xFE, 0xC6, 0x97,
                                0x16, 0x3D, 0x47, 0xF2  };
 
+       buf = kmemdup(set_def_chn, sizeof(set_def_chn), GFP_KERNEL);
+
+       if (!buf)
+               return -ENOMEM;
+
        ret = usb_control_msg(dev->udev, usb_sndctrlpipe(dev->udev, 0),
                        NR_USB_REQUEST_CHANNEL,
                        (USB_DIR_OUT | USB_TYPE_VENDOR), 0, 0,
-                       set_def_chn, sizeof(set_def_chn), USB_CTRL_SET_TIMEOUT);
+                       buf, sizeof(set_def_chn), USB_CTRL_SET_TIMEOUT);
+
+       kfree(buf);
+
        return ret;
 }