The patch titled
usb: drivers/usb/core/devio.c dereferences a userspace pointer
has been removed from the -mm tree. Its filename is
drivers-usb-core-devioc-dereference-userspace-pointer.patch
This patch was probably dropped from -mm because
it has now been merged into a subsystem tree or
into Linus's tree, or because it was folded into
its parent patch in the -mm tree.
------------------------------------------------------
Subject: usb: drivers/usb/core/devio.c dereferences a userspace pointer
From: Philippe Retornaz <couriousous@xxxxxxxxxxxx>
See http://bugzilla.kernel.org/show_bug.cgi?id=6617.
This function dereference a __user pointer.
(akpm: this code is deeply fishy. Are the types correct?)
Signed-off-by: Philippe Retornaz <couriousous@xxxxxxxxxxxx>
Cc: Greg KH <greg@xxxxxxxxx>
Signed-off-by: Andrew Morton <akpm@xxxxxxxx>
---
drivers/usb/core/devio.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff -puN drivers/usb/core/devio.c~drivers-usb-core-devioc-dereference-userspace-pointer drivers/usb/core/devio.c
--- devel/drivers/usb/core/devio.c~drivers-usb-core-devioc-dereference-userspace-pointer 2006-06-01 20:48:09.000000000 -0700
+++ devel-akpm/drivers/usb/core/devio.c 2006-06-01 20:48:09.000000000 -0700
@@ -1079,7 +1079,9 @@ static int proc_submiturb(struct dev_sta
if (copy_from_user(&uurb, arg, sizeof(uurb)))
return -EFAULT;
- return proc_do_submiturb(ps, &uurb, (((struct usbdevfs_urb __user *)arg)->iso_frame_desc), arg);
+ return proc_do_submiturb(ps, &uurb,
+ (struct usbdevfs_iso_packet_desc __user *)uurb.iso_frame_desc,
+ arg);
}
static int proc_unlinkurb(struct dev_state *ps, void __user *arg)
_
Patches currently in -mm which might be from couriousous@xxxxxxxxxxxx are
-
To unsubscribe from this list: send the line "unsubscribe mm-commits" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
