lkml.org 
[lkml]   [2012]   [Aug]   [7]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[ 022/109] usbdevfs: Correct amount of data copied to user in processcompl_compat
    Date
    From: Greg KH <gregkh@linuxfoundation.org>

    3.4-stable review patch. If anyone has any objections, please let me know.

    ------------------

    From: Hans de Goede <hdegoede@redhat.com>

    commit 2102e06a5f2e414694921f23591f072a5ba7db9f upstream.

    iso data buffers may have holes in them if some packets were short, so for
    iso urbs we should always copy the entire buffer, just like the regular
    processcompl does.

    Signed-off-by: Hans de Goede <hdegoede@redhat.com>
    Acked-by: Alan Stern <stern@rowland.harvard.edu>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    drivers/usb/core/devio.c | 10 +++++++---
    1 file changed, 7 insertions(+), 3 deletions(-)

    --- a/drivers/usb/core/devio.c
    +++ b/drivers/usb/core/devio.c
    @@ -1615,10 +1615,14 @@ static int processcompl_compat(struct as
    void __user *addr = as->userurb;
    unsigned int i;

    - if (as->userbuffer && urb->actual_length)
    - if (copy_to_user(as->userbuffer, urb->transfer_buffer,
    - urb->actual_length))
    + if (as->userbuffer && urb->actual_length) {
    + if (urb->number_of_packets > 0) /* Isochronous */
    + i = urb->transfer_buffer_length;
    + else /* Non-Isoc */
    + i = urb->actual_length;
    + if (copy_to_user(as->userbuffer, urb->transfer_buffer, i))
    return -EFAULT;
    + }
    if (put_user(as->status, &userurb->status))
    return -EFAULT;
    if (put_user(urb->actual_length, &userurb->actual_length))



    \
     
     \ /
      Last update: 2012-08-08 03:41    [W:4.118 / U:1.296 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site