Patch "catc: Use heap buffer for memory size test" has been added to the 4.4-stable tree

Patch "catc: Use heap buffer for memory size test" has been added to the 4.4-stable tree

[gregkh]

This is a note to let you know that I've just added the patch titled

    catc: Use heap buffer for memory size test

to the 4.4-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     catc-use-heap-buffer-for-memory-size-test.patch
and it can be found in the queue-4.4 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@vger.kernel.org> know about it.


>From 2d6a0e9de03ee658a9adc3bfb2f0ca55dff1e478 Mon Sep 17 00:00:00 2001
From: Ben Hutchings <ben@decadent.org.uk>
Date: Sat, 4 Feb 2017 16:57:04 +0000
Subject: catc: Use heap buffer for memory size test

From: Ben Hutchings <ben@decadent.org.uk>

commit 2d6a0e9de03ee658a9adc3bfb2f0ca55dff1e478 upstream.

Allocating USB buffers on the stack is not portable, and no longer
works on x86_64 (with VMAP_STACK enabled as per default).

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Signed-off-by: David S. Miller <davem@davemloft.net>
Cc: Brad Spengler <spender@grsecurity.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/net/usb/catc.c |   25 ++++++++++++++++++-------
 1 file changed, 18 insertions(+), 7 deletions(-)

--- a/drivers/net/usb/catc.c
+++ b/drivers/net/usb/catc.c
@@ -777,7 +777,7 @@ static int catc_probe(struct usb_interfa
 	struct net_device *netdev;
 	struct catc *catc;
 	u8 broadcast[ETH_ALEN];
-	int i, pktsz, ret;
+	int pktsz, ret;
 
 	if (usb_set_interface(usbdev,
 			intf->altsetting->desc.bInterfaceNumber, 1)) {
@@ -841,15 +841,24 @@ static int catc_probe(struct usb_interfa
                 catc->irq_buf, 2, catc_irq_done, catc, 1);
 
 	if (!catc->is_f5u011) {
+		u32 *buf;
+		int i;
+
 		dev_dbg(dev, "Checking memory size\n");
 
-		i = 0x12345678;
-		catc_write_mem(catc, 0x7a80, &i, 4);
-		i = 0x87654321;	
-		catc_write_mem(catc, 0xfa80, &i, 4);
-		catc_read_mem(catc, 0x7a80, &i, 4);
+		buf = kmalloc(4, GFP_KERNEL);
+		if (!buf) {
+			ret = -ENOMEM;
+			goto fail_free;
+		}
+
+		*buf = 0x12345678;
+		catc_write_mem(catc, 0x7a80, buf, 4);
+		*buf = 0x87654321;
+		catc_write_mem(catc, 0xfa80, buf, 4);
+		catc_read_mem(catc, 0x7a80, buf, 4);
 	  
-		switch (i) {
+		switch (*buf) {
 		case 0x12345678:
 			catc_set_reg(catc, TxBufCount, 8);
 			catc_set_reg(catc, RxBufCount, 32);
@@ -864,6 +873,8 @@ static int catc_probe(struct usb_interfa
 			dev_dbg(dev, "32k Memory\n");
 			break;
 		}
+
+		kfree(buf);
 	  
 		dev_dbg(dev, "Getting MAC from SEEROM.\n");
 	  


Patches currently in stable-queue which might be from ben@decadent.org.uk are

queue-4.4/dvb-usb-firmware-don-t-do-dma-on-stack.patch
queue-4.4/dvb-usb-don-t-use-stack-for-firmware-load.patch
queue-4.4/catc-combine-failure-cleanup-code-in-catc_probe.patch
queue-4.4/acpi-nfit-libnvdimm-fix-interleave-set-cookie-calculation-64-bit-comparison.patch
queue-4.4/virtio-console-avoid-dma-from-stack.patch
queue-4.4/rtc-tegra-implement-clock-handling.patch
queue-4.4/dvb-usb-v2-avoid-use-after-free.patch
queue-4.4/platform-x86-acer-wmi-setup-accelerometer-when-machine-has-appropriate-notify-event.patch
queue-4.4/catc-use-heap-buffer-for-memory-size-test.patch
queue-4.4/pegasus-use-heap-buffers-for-all-register-access.patch
queue-4.4/kvm-fix-page-struct-leak-in-handle_vmon.patch
queue-4.4/rtl8150-use-heap-buffers-for-all-register-access.patch