sc8800: tmp_buf: Cross-border access

diff --git a/drivers/misc/sc8800.c b/drivers/misc/sc8800.c
index 4e5ede699ab0d12e70c6dc3197318feac092a362..4ed2bb775b9fac8cd14bb61d6712f51b22c5e50f 100755 (executable)
--- a/drivers/misc/sc8800.c
+++ b/drivers/misc/sc8800.c
@@ -91,7 +91,7 @@ static DECLARE_RWSEM(sc8800_rsem);
 static DECLARE_RWSEM(sc8800_wsem);  
 struct sc8800_data *g_sc8800 = NULL;
 
-char tmp_buf[1024];
+void *tmp_buf = NULL;
 static int bp_rts(struct sc8800_data *sc8800)
 {
        return gpio_get_value(sc8800->slav_rts);
@@ -146,6 +146,12 @@ static void spi_in(struct sc8800_data *sc8800, char *tx_buf, unsigned len, int*
        struct spi_message message;
        struct spi_transfer tran;
 
+       tmp_buf = kzalloc(len, GFP_KERNEL);
+       if(!tmp_buf){
+               *err = -ENOMEM;
+               return;
+       }
+
        buf_swp(tx_buf, len);
 
        tran.tx_buf = (void *)tx_buf;
@@ -158,6 +164,7 @@ static void spi_in(struct sc8800_data *sc8800, char *tx_buf, unsigned len, int*
        spi_message_add_tail(&tran, &message);
        *err = spi_sync(sc8800->spi, &message);
        sc8800_print_buf(sc8800, tx_buf, __func__, len);
+       kfree(tmp_buf);
 }
 
 static void spi_out(struct sc8800_data *sc8800, char *rx_buf, unsigned len, int* err)
@@ -165,6 +172,12 @@ static void spi_out(struct sc8800_data *sc8800, char *rx_buf, unsigned len, int*
        struct spi_message message;
        struct spi_transfer tran;
 
+       tmp_buf = kzalloc(len, GFP_KERNEL);
+       if(!tmp_buf){
+               *err = -ENOMEM;
+               return;
+       }
+
        memset(rx_buf, 0, len);
        tran.tx_buf = tmp_buf;
        tran.rx_buf = (void *)rx_buf;
@@ -178,6 +191,7 @@ static void spi_out(struct sc8800_data *sc8800, char *rx_buf, unsigned len, int*
        sc8800_print_buf(sc8800, rx_buf, __func__, len);
 
        buf_swp(rx_buf, len);
+       kfree(tmp_buf);
 }
 
 static int ap_get_head(struct sc8800_data *sc8800, struct bp_head *packet)