iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[PATCH] usb: drivers/usb/core/devio.c dereferences a userspace pointer

Browse Source 
See http://bugzilla.kernel.org/show_bug.cgi?id=6617.

This function dereference a __user pointer.

Signed-off-by: Philippe Retornaz <couriousous@mandriva.org>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
This commit is contained in:
Philippe Retornaz 2006-06-01 20:48:46 -07:00 committed by Greg Kroah-Hartman
parent 6ad07129a8
commit 786dc1d3d7
1 changed files with 6 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
drivers/usb/core/devio.c
View File

@ -1078,7 +1078,9 @@ static int proc_submiturb(struct dev_state *ps, void __user *arg)
if (copy_from_user(&uurb, arg, sizeof(uurb)))
return -EFAULT;
return proc_do_submiturb(ps, &uurb, (((struct usbdevfs_urb __user *)arg)->iso_frame_desc), arg);
return proc_do_submiturb(ps, &uurb,
(struct usbdevfs_iso_packet_desc __user *)uurb.iso_frame_desc,
arg);
}
static int proc_unlinkurb(struct dev_state *ps, void __user *arg)
@ -1203,7 +1205,9 @@ static int proc_submiturb_compat(struct dev_state *ps, void __user *arg)
if (get_urb32(&uurb,(struct usbdevfs_urb32 *)arg))
return -EFAULT;
return proc_do_submiturb(ps, &uurb, ((struct usbdevfs_urb32 __user *)arg)->iso_frame_desc, arg);
return proc_do_submiturb(ps, &uurb,
(struct usbdevfs_iso_packet_desc __user *)uurb.iso_frame_desc,
arg);
}
static int processcompl_compat(struct async *as, void __user * __user *arg)