From: kfx <kfx@rock-chips.com>
Date: Wed, 30 May 2012 07:31:23 +0000 (+0800)
Subject: sc8800: tmp_buf: Cross-border access
X-Git-Tag: firefly_0821_release~9142^2~16
X-Git-Url: http://demsky.eecs.uci.edu/git/?a=commitdiff_plain;h=61e6526e5c37b0e37060117d79358e5ac04d6b80;p=firefly-linux-kernel-4.4.55.git

sc8800: tmp_buf: Cross-border access
---

diff --git a/drivers/misc/sc8800.c b/drivers/misc/sc8800.c
index 4e5ede699ab0..4ed2bb775b9f 100755
--- a/drivers/misc/sc8800.c
+++ b/drivers/misc/sc8800.c
@@ -91,7 +91,7 @@ static DECLARE_RWSEM(sc8800_rsem);
 static DECLARE_RWSEM(sc8800_wsem);  
 struct sc8800_data *g_sc8800 = NULL;
 
-char tmp_buf[1024];
+void *tmp_buf = NULL;
 static int bp_rts(struct sc8800_data *sc8800)
 {
 	return gpio_get_value(sc8800->slav_rts);
@@ -146,6 +146,12 @@ static void spi_in(struct sc8800_data *sc8800, char *tx_buf, unsigned len, int*
 	struct spi_message message;
 	struct spi_transfer tran;
 
+	tmp_buf = kzalloc(len, GFP_KERNEL);
+	if(!tmp_buf){
+		*err = -ENOMEM;
+		return;
+	}
+
 	buf_swp(tx_buf, len);
 
 	tran.tx_buf = (void *)tx_buf;
@@ -158,6 +164,7 @@ static void spi_in(struct sc8800_data *sc8800, char *tx_buf, unsigned len, int*
 	spi_message_add_tail(&tran, &message);
 	*err = spi_sync(sc8800->spi, &message);
 	sc8800_print_buf(sc8800, tx_buf, __func__, len);
+	kfree(tmp_buf);
 }
 
 static void spi_out(struct sc8800_data *sc8800, char *rx_buf, unsigned len, int* err)
@@ -165,6 +172,12 @@ static void spi_out(struct sc8800_data *sc8800, char *rx_buf, unsigned len, int*
 	struct spi_message message;
 	struct spi_transfer tran;
 
+	tmp_buf = kzalloc(len, GFP_KERNEL);
+	if(!tmp_buf){
+		*err = -ENOMEM;
+		return;
+	}
+
 	memset(rx_buf, 0, len);
 	tran.tx_buf = tmp_buf;
 	tran.rx_buf = (void *)rx_buf;
@@ -178,6 +191,7 @@ static void spi_out(struct sc8800_data *sc8800, char *rx_buf, unsigned len, int*
 	sc8800_print_buf(sc8800, rx_buf, __func__, len);
 
 	buf_swp(rx_buf, len);
+	kfree(tmp_buf);
 }
 
 static int ap_get_head(struct sc8800_data *sc8800, struct bp_head *packet)