usb: misc: usbtest: allocate size of urb array according to user parameter

Allocate the size of urb pointer array according to testusb's
parameter sglen, and limits the length of sglen as MAX_SGLEN
(128 currently).

Acked-by: Michal Nazarewicz <mina86@mina86.com>
Signed-off-by: Peter Chen <peter.chen@freescale.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>

diff --git a/drivers/usb/misc/usbtest.c b/drivers/usb/misc/usbtest.c
index 9517812a50e2982aa45db4102092c90e9732598f..8f294d716369d03c75bc578d5ebc02efb39fd3f6 100644 (file)
--- a/drivers/usb/misc/usbtest.c
+++ b/drivers/usb/misc/usbtest.c
@@ -95,6 +95,7 @@ static struct usb_device *testdev_to_usbdev(struct usbtest_dev *test)
        dev_warn(&(tdev)->intf->dev , fmt , ## args)
 
 #define GUARD_BYTE     0xA5
+#define MAX_SGLEN      128
 
 /*-------------------------------------------------------------------------*/
 
@@ -1911,10 +1912,7 @@ test_iso_queue(struct usbtest_dev *dev, struct usbtest_param *param,
        unsigned                i;
        unsigned long           packets = 0;
        int                     status = 0;
-       struct urb              *urbs[10];      /* FIXME no limit */
-
-       if (param->sglen > 10)
-               return -EDOM;
+       struct urb              *urbs[param->sglen];
 
        memset(&context, 0, sizeof(context));
        context.count = param->iterations * param->sglen;
@@ -2061,6 +2059,9 @@ usbtest_ioctl(struct usb_interface *intf, unsigned int code, void *buf)
        if (param->iterations <= 0)
                return -EINVAL;
 
+       if (param->sglen > MAX_SGLEN)
+               return -EINVAL;
+
        if (mutex_lock_interruptible(&dev->lock))
                return -ERESTARTSYS;