USB: mos7720: fix DMA buffers on stack and clean up send_mos_cmd

Change data-argument type from (void *) to (u8 *) to prevent endianess
problems.

Signed-off-by: Johan Hovold <jhovold@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

diff --git a/drivers/usb/serial/mos7720.c b/drivers/usb/serial/mos7720.c
index 763e32a..e081dc0 100644 (file)
--- a/drivers/usb/serial/mos7720.c
+++ b/drivers/usb/serial/mos7720.c
@@ -275,13 +275,11 @@ static void mos7720_bulk_out_data_callback(struct urb *urb)
  *     this function will be used for sending command to device
  */
 static int send_mos_cmd(struct usb_serial *serial, __u8 request, __u16 value,
-                       __u16 index, void *data)
+                       __u16 index, u8 *data)
 {
        int status;
-       unsigned int pipe;
+       u8 *buf;
        u16 product = le16_to_cpu(serial->dev->descriptor.idProduct);
-       __u8 requesttype;
-       __u16 size = 0x0000;
 
        if (value < MOS_MAX_PORT) {
                if (product == MOSCHIP_DEVICE_ID_7715)
@@ -298,21 +296,23 @@ static int send_mos_cmd(struct usb_serial *serial, __u8 request, __u16 value,
        }
 
        if (request == MOS_WRITE) {
-               request = (__u8)MOS_WRITE;
-               requesttype = (__u8)0x40;
-               value  = value + (__u16)*((unsigned char *)data);
-               data = NULL;
-               pipe = usb_sndctrlpipe(serial->dev, 0);
+               value = value + *data;
+               status = usb_control_msg(serial->dev,
+                               usb_sndctrlpipe(serial->dev, 0), MOS_WRITE,
+                               0x40, value, index, NULL, 0, MOS_WDR_TIMEOUT);
        } else {
-               request = (__u8)MOS_READ;
-               requesttype = (__u8)0xC0;
-               size = 0x01;
-               pipe = usb_rcvctrlpipe(serial->dev, 0);
+               buf = kmalloc(1, GFP_KERNEL);
+               if (!buf) {
+                       status = -ENOMEM;
+                       goto out;
+               }
+               status = usb_control_msg(serial->dev,
+                               usb_rcvctrlpipe(serial->dev, 0), MOS_READ,
+                               0xc0, value, index, buf, 1, MOS_WDR_TIMEOUT);
+               *data = *buf;
+               kfree(buf);
        }
-
-       status = usb_control_msg(serial->dev, pipe, request, requesttype,
-                                value, index, data, size, MOS_WDR_TIMEOUT);
-
+out:
        if (status < 0)
                dbg("Command Write failed Value %x index %x\n", value, index);