Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit d4a4683c authored by Greg Kroah-Hartman's avatar Greg Kroah-Hartman Committed by Greg Kroah-Hartman
Browse files

USB: usbfs: only copy the actual data received 



We need to only copy the data received by the device to userspace, not
the whole kernel buffer, which can contain "stale" data.

Thanks to Marcus Meissner for pointing this out and testing the fix.

Reported-by: default avatarMarcus Meissner <meissner@suse.de>
Tested-by: default avatarMarcus Meissner <meissner@suse.de>
Cc: Alan Stern <stern@rowland.harvard.edu>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: stable <stable@kernel.org>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@suse.de>
parent 0813e22d

drivers/usb/core/devio.c

+4 −4
Original line number Diff line number Diff line
@@ -1312,9 +1312,9 @@ static int processcompl(struct async *as, void __user * __user *arg) 
	void __user *addr = as->userurb;

	unsigned int i;



	if (as->userbuffer)

	if (as->userbuffer && urb->actual_length)

		if (copy_to_user(as->userbuffer, urb->transfer_buffer,

				 urb->transfer_buffer_length))

				 urb->actual_length))

			goto err_out;

	if (put_user(as->status, &userurb->status))

		goto err_out;
@@ -1475,9 +1475,9 @@ static int processcompl_compat(struct async *as, void __user * __user *arg) 
	void __user *addr = as->userurb;

	unsigned int i;



	if (as->userbuffer)

	if (as->userbuffer && urb->actual_length)

		if (copy_to_user(as->userbuffer, urb->transfer_buffer,

				 urb->transfer_buffer_length))

				 urb->actual_length))

			return -EFAULT;

	if (put_user(as->status, &userurb->status))

		return -EFAULT;