From: Philippe Retornaz <[EMAIL PROTECTED]>
See http://bugzilla.kernel.org/show_bug.cgi?id=6617.
This function dereference a __user pointer.
Signed-off-by: Philippe Retornaz <[EMAIL PROTECTED]>
Signed-off-by: Andrew Morton <[EMAIL PROTECTED]>
Signed-off-by: Greg Kroah-Hartman <[EMAIL PROTECTED]>
---
drivers/usb/core/devio.c | 8 ++++++--
1 files changed, 6 insertions(+), 2 deletions(-)
diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c
index df3fb57..2eda52f 100644
--- a/drivers/usb/core/devio.c
+++ b/drivers/usb/core/devio.c
@@ -1078,7 +1078,9 @@ static int proc_submiturb(struct dev_sta
if (copy_from_user(&uurb, arg, sizeof(uurb)))
return -EFAULT;
- return proc_do_submiturb(ps, &uurb, (((struct usbdevfs_urb __user
*)arg)->iso_frame_desc), arg);
+ return proc_do_submiturb(ps, &uurb,
+ (struct usbdevfs_iso_packet_desc __user *)uurb.iso_frame_desc,
+ arg);
}
static int proc_unlinkurb(struct dev_state *ps, void __user *arg)
@@ -1203,7 +1205,9 @@ static int proc_submiturb_compat(struct
if (get_urb32(&uurb,(struct usbdevfs_urb32 *)arg))
return -EFAULT;
- return proc_do_submiturb(ps, &uurb, ((struct usbdevfs_urb32 __user
*)arg)->iso_frame_desc, arg);
+ return proc_do_submiturb(ps, &uurb,
+ (struct usbdevfs_iso_packet_desc __user *)uurb.iso_frame_desc,
+ arg);
}
static int processcompl_compat(struct async *as, void __user * __user *arg)
--
1.4.0
All the advantages of Linux Managed Hosting--Without the Cost and Risk!
Fully trained technicians. The highest number of Red Hat certifications in
the hosting industry. Fanatical Support. Click to learn more
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=107521&bid=248729&dat=121642
_______________________________________________
linux-usb-devel@lists.sourceforge.net
To unsubscribe, use the last form field at:
https://lists.sourceforge.net/lists/listinfo/linux-usb-devel
