瀏覽代碼

USB: isight: fix kernel bug when loading firmware

We were sending data on the stack when uploading firmware, which causes
some machines fits, and is not allowed.  Fix this by using the buffer we
already had around for this very purpose.

Reported-by: Wouter M. Koolen <wmkoolen@cwi.nl>
Tested-by: Wouter M. Koolen <wmkoolen@cwi.nl>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Greg Kroah-Hartman 13 年之前
父節點
當前提交
59bf5cf94f
共有 1 個文件被更改,包括 4 次插入2 次删除
  1. 4 2
      drivers/usb/misc/isight_firmware.c

+ 4 - 2
drivers/usb/misc/isight_firmware.c

@@ -55,8 +55,9 @@ static int isight_firmware_load(struct usb_interface *intf,
 
 
 	ptr = firmware->data;
 	ptr = firmware->data;
 
 
+	buf[0] = 0x01;
 	if (usb_control_msg
 	if (usb_control_msg
-	    (dev, usb_sndctrlpipe(dev, 0), 0xa0, 0x40, 0xe600, 0, "\1", 1,
+	    (dev, usb_sndctrlpipe(dev, 0), 0xa0, 0x40, 0xe600, 0, buf, 1,
 	     300) != 1) {
 	     300) != 1) {
 		printk(KERN_ERR
 		printk(KERN_ERR
 		       "Failed to initialise isight firmware loader\n");
 		       "Failed to initialise isight firmware loader\n");
@@ -100,8 +101,9 @@ static int isight_firmware_load(struct usb_interface *intf,
 		}
 		}
 	}
 	}
 
 
+	buf[0] = 0x00;
 	if (usb_control_msg
 	if (usb_control_msg
-	    (dev, usb_sndctrlpipe(dev, 0), 0xa0, 0x40, 0xe600, 0, "\0", 1,
+	    (dev, usb_sndctrlpipe(dev, 0), 0xa0, 0x40, 0xe600, 0, buf, 1,
 	     300) != 1) {
 	     300) != 1) {
 		printk(KERN_ERR "isight firmware loading completion failed\n");
 		printk(KERN_ERR "isight firmware loading completion failed\n");
 		ret = -ENODEV;
 		ret = -ENODEV;