Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 64d65872 authored by Alan Stern's avatar Alan Stern Committed by Greg Kroah-Hartman
Browse files

USB: fix oops in usb_sg_init() 



This patch (as1401) fixes a bug in usb_sg_init() that can cause an
invalid pointer dereference.  An inner loop reuses some local variables
in an unsafe manner, so new variables are introduced.

Signed-off-by: default avatarAlan Stern <stern@rowland.harvard.edu>
Tested-by: default avatarAjay Kumar Gupta <ajay.gupta@ti.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@suse.de>
parent 3b49d231

drivers/usb/core/message.c

+5 −2
Original line number Diff line number Diff line
@@ -416,8 +416,11 @@ int usb_sg_init(struct usb_sg_request *io, struct usb_device *dev, 
			/* A length of zero means transfer the whole sg list */

			len = length;

			if (len == 0) {

				for_each_sg(sg, sg, nents, i)

					len += sg->length;

				struct scatterlist	*sg2;

				int			j;



				for_each_sg(sg, sg2, nents, j)

					len += sg2->length;

			}

		} else {

			/*