iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Revert "[PATCH] usb: drivers/usb/core/devio.c dereferences a userspace pointer"

Browse Source 
This reverts commit 786dc1d3d7.

As Al so eloquently points out, the patch is crap. The old code was fine,
the new code was bogus.

It never dereferenced a user pointer, the "->" operator was to an array
member, which gives the _address_ of the member (in user space), not an
actual dereference at all.

Signed-off-by: Linus Torvalds <torvalds@osdl.org>
This commit is contained in:
Linus Torvalds 2006-06-24 17:47:09 -07:00
parent abb1cf3cb9
commit 83626b0127
1 changed files with 2 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
drivers/usb/core/devio.c
View File

@ -1078,9 +1078,7 @@ static int proc_submiturb(struct dev_state *ps, void __user *arg)
if (copy_from_user(&uurb, arg, sizeof(uurb)))
return -EFAULT;
return proc_do_submiturb(ps, &uurb,
(struct usbdevfs_iso_packet_desc __user *)uurb.iso_frame_desc,
arg);
return proc_do_submiturb(ps, &uurb, (((struct usbdevfs_urb __user *)arg)->iso_frame_desc), arg);
}
static int proc_unlinkurb(struct dev_state *ps, void __user *arg)
@ -1205,9 +1203,7 @@ static int proc_submiturb_compat(struct dev_state *ps, void __user *arg)
if (get_urb32(&uurb,(struct usbdevfs_urb32 *)arg))
return -EFAULT;
return proc_do_submiturb(ps, &uurb,
(struct usbdevfs_iso_packet_desc __user *)uurb.iso_frame_desc,
arg);
return proc_do_submiturb(ps, &uurb, ((struct usbdevfs_urb32 __user *)arg)->iso_frame_desc, arg);
}
static int processcompl_compat(struct async *as, void __user * __user *arg)