Each of snd_pcm_hw_refine_old_user() and snd_pcm_hw_params_old_user() consume 856 bytes of stack and can invoke deep calls via the page allocator. Signed-off-by: Andrew Morton --- 25-akpm/sound/core/pcm_native.c | 73 ++++++++++++++++++++++++++++++---------- 1 files changed, 55 insertions(+), 18 deletions(-) diff -puN sound/core/pcm_native.c~pcm_native-stack-reduction sound/core/pcm_native.c --- 25/sound/core/pcm_native.c~pcm_native-stack-reduction 2004-06-03 19:46:31.558438560 -0700 +++ 25-akpm/sound/core/pcm_native.c 2004-06-03 19:46:31.564437648 -0700 @@ -3133,31 +3133,68 @@ static void snd_pcm_hw_convert_to_old_pa static int snd_pcm_hw_refine_old_user(snd_pcm_substream_t * substream, struct sndrv_pcm_hw_params_old __user * _oparams) { - snd_pcm_hw_params_t params; - struct sndrv_pcm_hw_params_old oparams; + snd_pcm_hw_params_t *params; + struct sndrv_pcm_hw_params_old *oparams = NULL; int err; - if (copy_from_user(&oparams, _oparams, sizeof(oparams))) - return -EFAULT; - snd_pcm_hw_convert_from_old_params(¶ms, &oparams); - err = snd_pcm_hw_refine(substream, ¶ms); - snd_pcm_hw_convert_to_old_params(&oparams, ¶ms); - if (copy_to_user(_oparams, &oparams, sizeof(oparams))) - return -EFAULT; + + params = kmalloc(sizeof(*params), GFP_KERNEL); + if (!params) { + err = -ENOMEM; + goto out; + } + oparams = kmalloc(sizeof(*oparams), GFP_KERNEL); + if (!oparams) { + err = -ENOMEM; + goto out; + } + + if (copy_from_user(oparams, _oparams, sizeof(*oparams))) { + err = -EFAULT; + goto out; + } + snd_pcm_hw_convert_from_old_params(params, oparams); + err = snd_pcm_hw_refine(substream, params); + snd_pcm_hw_convert_to_old_params(oparams, params); + if (copy_to_user(_oparams, oparams, sizeof(*oparams))) { + if (!err) + err = -EFAULT; + } +out: + kfree(params); + kfree(oparams); return err; } static int snd_pcm_hw_params_old_user(snd_pcm_substream_t * substream, struct sndrv_pcm_hw_params_old __user * _oparams) { - snd_pcm_hw_params_t params; - struct sndrv_pcm_hw_params_old oparams; + snd_pcm_hw_params_t *params; + struct sndrv_pcm_hw_params_old *oparams = NULL; int err; - if (copy_from_user(&oparams, _oparams, sizeof(oparams))) - return -EFAULT; - snd_pcm_hw_convert_from_old_params(¶ms, &oparams); - err = snd_pcm_hw_params(substream, ¶ms); - snd_pcm_hw_convert_to_old_params(&oparams, ¶ms); - if (copy_to_user(_oparams, &oparams, sizeof(oparams))) - return -EFAULT; + + params = kmalloc(sizeof(*params), GFP_KERNEL); + if (!params) { + err = -ENOMEM; + goto out; + } + oparams = kmalloc(sizeof(*oparams), GFP_KERNEL); + if (!oparams) { + err = -ENOMEM; + goto out; + } + if (copy_from_user(oparams, _oparams, sizeof(*oparams))) { + err = -EFAULT; + goto out; + } + snd_pcm_hw_convert_from_old_params(params, oparams); + err = snd_pcm_hw_params(substream, params); + snd_pcm_hw_convert_to_old_params(oparams, params); + if (copy_to_user(_oparams, oparams, sizeof(*oparams))) { + if (!err) + err = -EFAULT; + } +out: + kfree(params); + kfree(oparams); return err; } _