* PATCH: 2.6.7-rc3 drivers/usb/core/devio.c: user/kernel pointer bugs
@ 2004-06-09 22:40 Robert T. Johnson
2004-06-10 16:45 ` Greg KH
0 siblings, 1 reply; 2+ messages in thread
From: Robert T. Johnson @ 2004-06-09 22:40 UTC (permalink / raw)
To: linux-usb-devel; +Cc: Linux Kernel
Since ctrl is copied in from userspace, ctrl.data cannot safely be
dereferenced. Let me know if you have any questions or if I've made
a mistake.
Best,
Rob
--- linux-2.6.7-rc3-full/drivers/usb/core/devio.c.orig Wed Jun 9 12:50:34 2004
+++ linux-2.6.7-rc3-full/drivers/usb/core/devio.c Wed Jun 9 12:49:50 2004
@@ -558,7 +558,7 @@ static int proc_control(struct dev_state
if (usbfs_snoop) {
dev_info(&dev->dev, "control read: data ");
for (j = 0; j < ctrl.wLength; ++j)
- printk ("%02x ", (unsigned char)((char *)ctrl.data)[j]);
+ printk ("%02x ", (unsigned char)(tbuf)[j]);
printk("\n");
}
if (copy_to_user(ctrl.data, tbuf, ctrl.wLength)) {
@@ -578,7 +578,7 @@ static int proc_control(struct dev_state
if (usbfs_snoop) {
dev_info(&dev->dev, "control write: data: ");
for (j = 0; j < ctrl.wLength; ++j)
- printk ("%02x ", (unsigned char)((char *)ctrl.data)[j]);
+ printk ("%02x ", (unsigned char)(tbuf)[j]);
printk("\n");
}
i = usb_control_msg(dev, usb_sndctrlpipe(dev, 0), ctrl.bRequest, ctrl.bRequestType,
^ permalink raw reply [flat|nested] 2+ messages in thread
* Re: PATCH: 2.6.7-rc3 drivers/usb/core/devio.c: user/kernel pointer bugs
2004-06-09 22:40 PATCH: 2.6.7-rc3 drivers/usb/core/devio.c: user/kernel pointer bugs Robert T. Johnson
@ 2004-06-10 16:45 ` Greg KH
0 siblings, 0 replies; 2+ messages in thread
From: Greg KH @ 2004-06-10 16:45 UTC (permalink / raw)
To: Robert T. Johnson; +Cc: linux-usb-devel, Linux Kernel
On Wed, Jun 09, 2004 at 03:40:50PM -0700, Robert T. Johnson wrote:
> Since ctrl is copied in from userspace, ctrl.data cannot safely be
> dereferenced. Let me know if you have any questions or if I've made
> a mistake.
Oops, I added this bug, sorry about that, good catch.
I've applied this to my trees, thanks.
greg k-h
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2004-06-10 16:46 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2004-06-09 22:40 PATCH: 2.6.7-rc3 drivers/usb/core/devio.c: user/kernel pointer bugs Robert T. Johnson
2004-06-10 16:45 ` Greg KH
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox