USB: ch341: fix DMA buffer on stack

Signed-off-by: Johan Hovold <jhovold@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

diff --git a/drivers/usb/serial/ch341.c b/drivers/usb/serial/ch341.c
index 5e455f4..2942c6d 100644 (file)
--- a/drivers/usb/serial/ch341.c
+++ b/drivers/usb/serial/ch341.c
@@ -392,16 +392,22 @@ static void ch341_break_ctl(struct tty_struct *tty, int break_state)
        struct usb_serial_port *port = tty->driver_data;
        int r;
        uint16_t reg_contents;
-       uint8_t break_reg[2];
+       uint8_t *break_reg;
 
        dbg("%s()", __func__);
 
+       break_reg = kmalloc(2, GFP_KERNEL);
+       if (!break_reg) {
+               dev_err(&port->dev, "%s - kmalloc failed\n", __func__);
+               return;
+       }
+
        r = ch341_control_in(port->serial->dev, CH341_REQ_READ_REG,
-                       ch341_break_reg, 0, break_reg, sizeof(break_reg));
+                       ch341_break_reg, 0, break_reg, 2);
        if (r < 0) {
                dev_err(&port->dev, "%s - USB control read error (%d)\n",
                                __func__, r);
-               return;
+               goto out;
        }
        dbg("%s - initial ch341 break register contents - reg1: %x, reg2: %x",
                        __func__, break_reg[0], break_reg[1]);
@@ -422,6 +428,8 @@ static void ch341_break_ctl(struct tty_struct *tty, int break_state)
        if (r < 0)
                dev_err(&port->dev, "%s - USB control write error (%d)\n",
                                __func__, r);
+out:
+       kfree(break_reg);
 }
 
 static int ch341_tiocmset(struct tty_struct *tty, struct file *file,