DriverDev-Devel Archive on lore.kernel.org
 help / color / Atom feed
* [PATCH 3/4] staging: vt6656: vnt_usb_send_context remove variable data.
@ 2020-05-16 10:44 Malcolm Priestley
  0 siblings, 0 replies; only message in thread
From: Malcolm Priestley @ 2020-05-16 10:44 UTC (permalink / raw)
  To: Greg Kroah-Hartman; +Cc: devel, linux-wireless

A limit is also placed in vnt_tx_context of MAX_TOTAL_SIZE_WITH_ALL_HEADERS
limiting size.

Signed-off-by: Malcolm Priestley <tvboxspy@gmail.com>
---
 drivers/staging/vt6656/device.h  | 1 -
 drivers/staging/vt6656/rxtx.c    | 3 ---
 drivers/staging/vt6656/usbpipe.c | 5 +++++
 3 files changed, 5 insertions(+), 4 deletions(-)

diff --git a/drivers/staging/vt6656/device.h b/drivers/staging/vt6656/device.h
index 074b98dfac91..08294b21c4e9 100644
--- a/drivers/staging/vt6656/device.h
+++ b/drivers/staging/vt6656/device.h
@@ -250,7 +250,6 @@ struct vnt_usb_send_context {
 	u8 pkt_type;
 	u8 need_ack;
 	bool in_use;
-	unsigned char data[MAX_TOTAL_SIZE_WITH_ALL_HEADERS];
 };
 
 /*
diff --git a/drivers/staging/vt6656/rxtx.c b/drivers/staging/vt6656/rxtx.c
index cf194c95df03..8f9904c8045c 100644
--- a/drivers/staging/vt6656/rxtx.c
+++ b/drivers/staging/vt6656/rxtx.c
@@ -73,9 +73,6 @@ static struct vnt_usb_send_context
 		context = priv->tx_context[ii];
 		if (!context->in_use) {
 			context->in_use = true;
-			memset(context->data, 0,
-			       MAX_TOTAL_SIZE_WITH_ALL_HEADERS);
-
 			context->hdr = NULL;
 
 			return context;
diff --git a/drivers/staging/vt6656/usbpipe.c b/drivers/staging/vt6656/usbpipe.c
index 904645fa0eb0..43f1ef32a9ce 100644
--- a/drivers/staging/vt6656/usbpipe.c
+++ b/drivers/staging/vt6656/usbpipe.c
@@ -463,6 +463,11 @@ int vnt_tx_context(struct vnt_private *priv,
 		return -ENODEV;
 	}
 
+	if (context->buf_len > MAX_TOTAL_SIZE_WITH_ALL_HEADERS) {
+		context->in_use = false;
+		return -E2BIG;
+	}
+
 	usb_fill_bulk_urb(urb,
 			  priv->usb,
 			  usb_sndbulkpipe(priv->usb, 3),
-- 
2.25.1
_______________________________________________
devel mailing list
devel@linuxdriverproject.org
http://driverdev.linuxdriverproject.org/mailman/listinfo/driverdev-devel

^ permalink raw reply	[flat|nested] only message in thread

only message in thread, back to index

Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-05-16 10:44 [PATCH 3/4] staging: vt6656: vnt_usb_send_context remove variable data Malcolm Priestley

DriverDev-Devel Archive on lore.kernel.org

Archives are clonable:
	git clone --mirror https://lore.kernel.org/driverdev-devel/0 driverdev-devel/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 driverdev-devel driverdev-devel/ https://lore.kernel.org/driverdev-devel \
		driverdev-devel@linuxdriverproject.org devel@driverdev.osuosl.org
	public-inbox-index driverdev-devel

Example config snippet for mirrors

Newsgroup available over NNTP:
	nntp://nntp.lore.kernel.org/org.linuxdriverproject.driverdev-devel


AGPL code for this site: git clone https://public-inbox.org/public-inbox.git