This patch (as1401) fixes a bug in usb_sg_init() that can cause an
invalid pointer dereference. An inner loop reuses some local variables
in an unsafe manner, so new variables are introduced.
Signed-off-by: Alan Stern <stern@xxxxxxxxxxxxxxxxxxx>
Tested-by: Ajay Kumar Gupta <ajay.gupta@xxxxxx>
---
Greg, this fix needs to get into 2.6.35.
Index: usb-2.6/drivers/usb/core/message.c
===================================================================
--- usb-2.6.orig/drivers/usb/core/message.c
+++ usb-2.6/drivers/usb/core/message.c
@@ -416,8 +416,11 @@ int usb_sg_init(struct usb_sg_request *i
/* A length of zero means transfer the whole sg list */
len = length;
if (len == 0) {
- for_each_sg(sg, sg, nents, i)
- len += sg->length;
+ struct scatterlist *sg2;
+ int j;
+
+ for_each_sg(sg, sg2, nents, j)
+ len += sg2->length;
}
} else {
/*
--
To unsubscribe from this list: send the line "unsubscribe linux-usb" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
