summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorGreg KH <greg@kroah.com>2010-02-15 09:37:46 -0800
committerGreg Kroah-Hartman <gregkh@suse.de>2010-02-16 15:11:01 -0800
commitd4a4683ca054ed9917dfc9e3ff0f7ecf74ad90d6 (patch)
tree087b4ad7f541d166147f85941020bfbccfa3b0ba
parent0813e22d4e0d618eac9b47bec942bf856adca4c5 (diff)
downloadlinux-3.10-d4a4683ca054ed9917dfc9e3ff0f7ecf74ad90d6.tar.gz
linux-3.10-d4a4683ca054ed9917dfc9e3ff0f7ecf74ad90d6.tar.bz2
linux-3.10-d4a4683ca054ed9917dfc9e3ff0f7ecf74ad90d6.zip
USB: usbfs: only copy the actual data received
We need to only copy the data received by the device to userspace, not the whole kernel buffer, which can contain "stale" data. Thanks to Marcus Meissner for pointing this out and testing the fix. Reported-by: Marcus Meissner <meissner@suse.de> Tested-by: Marcus Meissner <meissner@suse.de> Cc: Alan Stern <stern@rowland.harvard.edu> Cc: Linus Torvalds <torvalds@linux-foundation.org> Cc: stable <stable@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
-rw-r--r--drivers/usb/core/devio.c8
1 files changed, 4 insertions, 4 deletions
diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c
index 6e8bcdfd23b..ca948bbc388 100644
--- a/drivers/usb/core/devio.c
+++ b/drivers/usb/core/devio.c
@@ -1312,9 +1312,9 @@ static int processcompl(struct async *as, void __user * __user *arg)
void __user *addr = as->userurb;
unsigned int i;
- if (as->userbuffer)
+ if (as->userbuffer && urb->actual_length)
if (copy_to_user(as->userbuffer, urb->transfer_buffer,
- urb->transfer_buffer_length))
+ urb->actual_length))
goto err_out;
if (put_user(as->status, &userurb->status))
goto err_out;
@@ -1475,9 +1475,9 @@ static int processcompl_compat(struct async *as, void __user * __user *arg)
void __user *addr = as->userurb;
unsigned int i;
- if (as->userbuffer)
+ if (as->userbuffer && urb->actual_length)
if (copy_to_user(as->userbuffer, urb->transfer_buffer,
- urb->transfer_buffer_length))
+ urb->actual_length))
return -EFAULT;
if (put_user(as->status, &userurb->status))
return -EFAULT;