Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 83626b01 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Revert "[PATCH] usb: drivers/usb/core/devio.c dereferences a userspace pointer" 



This reverts commit 786dc1d3.

As Al so eloquently points out, the patch is crap. The old code was fine,
the new code was bogus.

It never dereferenced a user pointer, the "->" operator was to an array
member, which gives the _address_ of the member (in user space), not an
actual dereference at all.

Signed-off-by: default avatarLinus Torvalds <torvalds@osdl.org>
parent abb1cf3c

drivers/usb/core/devio.c

+2 −6
Original line number Original line Diff line number Diff line
@@ -1078,9 +1078,7 @@ static int proc_submiturb(struct dev_state *ps, void __user *arg) 
	if (copy_from_user(&uurb, arg, sizeof(uurb)))

	if (copy_from_user(&uurb, arg, sizeof(uurb)))

		return -EFAULT;

		return -EFAULT;





	return proc_do_submiturb(ps, &uurb,

	return proc_do_submiturb(ps, &uurb, (((struct usbdevfs_urb __user *)arg)->iso_frame_desc), arg);

		(struct usbdevfs_iso_packet_desc __user *)uurb.iso_frame_desc,

		arg);

}

}





static int proc_unlinkurb(struct dev_state *ps, void __user *arg)

static int proc_unlinkurb(struct dev_state *ps, void __user *arg)
@@ -1205,9 +1203,7 @@ static int proc_submiturb_compat(struct dev_state *ps, void __user *arg) 
	if (get_urb32(&uurb,(struct usbdevfs_urb32 *)arg))

	if (get_urb32(&uurb,(struct usbdevfs_urb32 *)arg))

		return -EFAULT;

		return -EFAULT;





	return proc_do_submiturb(ps, &uurb,

	return proc_do_submiturb(ps, &uurb, ((struct usbdevfs_urb32 __user *)arg)->iso_frame_desc, arg);

		(struct usbdevfs_iso_packet_desc __user *)uurb.iso_frame_desc,

		arg);

}

}





static int processcompl_compat(struct async *as, void __user * __user *arg)

static int processcompl_compat(struct async *as, void __user * __user *arg)