Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 786dc1d3 authored by Philippe Retornaz's avatar Philippe Retornaz Committed by Greg Kroah-Hartman
Browse files

[PATCH] usb: drivers/usb/core/devio.c dereferences a userspace pointer 

See http://bugzilla.kernel.org/show_bug.cgi?id=6617

.

This function dereference a __user pointer.

Signed-off-by: default avatarPhilippe Retornaz <couriousous@mandriva.org>
Signed-off-by: default avatarAndrew Morton <akpm@osdl.org>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@suse.de>
parent 6ad07129

drivers/usb/core/devio.c

+6 −2
Original line number Diff line number Diff line
@@ -1078,7 +1078,9 @@ static int proc_submiturb(struct dev_state *ps, void __user *arg) 
	if (copy_from_user(&uurb, arg, sizeof(uurb)))

		return -EFAULT;



	return proc_do_submiturb(ps, &uurb, (((struct usbdevfs_urb __user *)arg)->iso_frame_desc), arg);

	return proc_do_submiturb(ps, &uurb,

		(struct usbdevfs_iso_packet_desc __user *)uurb.iso_frame_desc,

		arg);

}



static int proc_unlinkurb(struct dev_state *ps, void __user *arg)
@@ -1203,7 +1205,9 @@ static int proc_submiturb_compat(struct dev_state *ps, void __user *arg) 
	if (get_urb32(&uurb,(struct usbdevfs_urb32 *)arg))

		return -EFAULT;



	return proc_do_submiturb(ps, &uurb, ((struct usbdevfs_urb32 __user *)arg)->iso_frame_desc, arg);

	return proc_do_submiturb(ps, &uurb,

		(struct usbdevfs_iso_packet_desc __user *)uurb.iso_frame_desc,

		arg);

}



static int processcompl_compat(struct async *as, void __user * __user *arg)