| From 424c6e1471da90717cbe398e1a79c95dc9799f5a Mon Sep 17 00:00:00 2001 |
| From: Hans de Goede <hdegoede@redhat.com> |
| Date: Wed, 4 Jul 2012 09:18:01 +0200 |
| Subject: [PATCH] usbdevfs: Correct amount of data copied to user in |
| processcompl_compat |
| |
| commit 2102e06a5f2e414694921f23591f072a5ba7db9f upstream. |
| |
| iso data buffers may have holes in them if some packets were short, so for |
| iso urbs we should always copy the entire buffer, just like the regular |
| processcompl does. |
| |
| Signed-off-by: Hans de Goede <hdegoede@redhat.com> |
| Acked-by: Alan Stern <stern@rowland.harvard.edu> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> |
| --- |
| drivers/usb/core/devio.c | 10 +++++++--- |
| 1 file changed, 7 insertions(+), 3 deletions(-) |
| |
| diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c |
| index 85a496754780..3437cf2cdcaf 100644 |
| --- a/drivers/usb/core/devio.c |
| +++ b/drivers/usb/core/devio.c |
| @@ -1527,10 +1527,14 @@ static int processcompl_compat(struct async *as, void __user * __user *arg) |
| void __user *addr = as->userurb; |
| unsigned int i; |
| |
| - if (as->userbuffer && urb->actual_length) |
| - if (copy_to_user(as->userbuffer, urb->transfer_buffer, |
| - urb->actual_length)) |
| + if (as->userbuffer && urb->actual_length) { |
| + if (urb->number_of_packets > 0) /* Isochronous */ |
| + i = urb->transfer_buffer_length; |
| + else /* Non-Isoc */ |
| + i = urb->actual_length; |
| + if (copy_to_user(as->userbuffer, urb->transfer_buffer, i)) |
| return -EFAULT; |
| + } |
| if (put_user(as->status, &userurb->status)) |
| return -EFAULT; |
| if (put_user(urb->actual_length, &userurb->actual_length)) |
| -- |
| 1.8.5.2 |
| |
