Patchwork [3.5.y.z,extended,stable] Patch "udldrmfb: udl_get_edid: usb_control_msg buffer must not be" has been added to staging queue

mail settings
Submitter Herton Ronaldo Krzesinski
Date Jan. 23, 2013, 4:44 a.m.
Message ID <>
Download mbox | patch
Permalink /patch/214782/
State New
Headers show


Herton Ronaldo Krzesinski - Jan. 23, 2013, 4:44 a.m.
This is a note to let you know that I have just added a patch titled

    udldrmfb: udl_get_edid: usb_control_msg buffer must not be

to the linux-3.5.y-queue branch of the 3.5.y.z extended stable tree 
which can be found at:;a=shortlog;h=refs/heads/linux-3.5.y-queue

If you, or anyone else, feels it should not be added to this tree, please 
reply to this email.

For more information about the 3.5.y.z tree, see



From 0a2cce875514c66e502c72653ee72c7f79aa29ea Mon Sep 17 00:00:00 2001
From: Hans de Goede <>
Date: Fri, 11 Jan 2013 12:08:57 +0100
Subject: [PATCH] udldrmfb: udl_get_edid: usb_control_msg buffer must not be
 on the stack

commit 242187b362555849e8c971dfbbfd55f8bd9fa717 upstream.

The buffer passed to usb_control_msg may end up in scatter-gather list, and
may thus not be on the stack. Having it on the stack usually works on x86, but
not on other archs.

Signed-off-by: Hans de Goede <>
Signed-off-by: Dave Airlie <>
Signed-off-by: Herton Ronaldo Krzesinski <>
 drivers/gpu/drm/udl/udl_connector.c |    8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)



diff --git a/drivers/gpu/drm/udl/udl_connector.c b/drivers/gpu/drm/udl/udl_connector.c
index 1230bc0..b7780dd 100644
--- a/drivers/gpu/drm/udl/udl_connector.c
+++ b/drivers/gpu/drm/udl/udl_connector.c
@@ -22,13 +22,17 @@ 
 static u8 *udl_get_edid(struct udl_device *udl)
 	u8 *block;
-	char rbuf[3];
+	char *rbuf;
 	int ret, i;

 	block = kmalloc(EDID_LENGTH, GFP_KERNEL);
 	if (block == NULL)
 		return NULL;

+	rbuf = kmalloc(2, GFP_KERNEL);
+	if (rbuf == NULL)
+		goto error;
 	for (i = 0; i < EDID_LENGTH; i++) {
 		ret = usb_control_msg(udl->ddev->usbdev,
 				      usb_rcvctrlpipe(udl->ddev->usbdev, 0), (0x02),
@@ -42,10 +46,12 @@  static u8 *udl_get_edid(struct udl_device *udl)
 		block[i] = rbuf[1];

+	kfree(rbuf);
 	return block;

+	kfree(rbuf);
 	return NULL;