usb patch

1 files changed, 46 insertions, 0 deletions

diff --git a/usb/usb-drivers-usb-core-devio.c-dereferences-a-userspace-pointer.patch b/usb/usb-drivers-usb-core-devio.c-dereferences-a-userspace-pointer.patch
new file mode 100644
index 0000000000000..32c0b9aafd852
--- /dev/null
+++ b/usb/usb-drivers-usb-core-devio.c-dereferences-a-userspace-pointer.patch
@@ -0,0 +1,46 @@
+From linux-usb-devel-bounces@lists.sourceforge.net  Fri Jun  2 16:36:04 2006
+Message-Id: <200606020344.k523iRwc029474@shell0.pdx.osdl.net>
+From: Philippe Retornaz <couriousous@mandriva.org>
+To: greg@kroah.com
+Date: Thu, 01 Jun 2006 20:48:46 -0700
+Cc: akpm@osdl.org, couriousous@mandriva.org
+Subject: usb: drivers/usb/core/devio.c dereferences a userspace pointer
+
+From: Philippe Retornaz <couriousous@mandriva.org>
+
+See http://bugzilla.kernel.org/show_bug.cgi?id=6617.
+
+This function dereference a __user pointer.
+
+Signed-off-by: Philippe Retornaz <couriousous@mandriva.org>
+Signed-off-by: Andrew Morton <akpm@osdl.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/core/devio.c |    8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+--- gregkh-2.6.orig/drivers/usb/core/devio.c
++++ gregkh-2.6/drivers/usb/core/devio.c
+@@ -1078,7 +1078,9 @@ static int proc_submiturb(struct dev_sta
+ 	if (copy_from_user(&uurb, arg, sizeof(uurb)))
+ 		return -EFAULT;
+ 
+-	return proc_do_submiturb(ps, &uurb, (((struct usbdevfs_urb __user *)arg)->iso_frame_desc), arg);
++	return proc_do_submiturb(ps, &uurb,
++		(struct usbdevfs_iso_packet_desc __user *)uurb.iso_frame_desc,
++		arg);
+ }
+ 
+ static int proc_unlinkurb(struct dev_state *ps, void __user *arg)
+@@ -1203,7 +1205,9 @@ static int proc_submiturb_compat(struct 
+ 	if (get_urb32(&uurb,(struct usbdevfs_urb32 *)arg))
+ 		return -EFAULT;
+ 
+-	return proc_do_submiturb(ps, &uurb, ((struct usbdevfs_urb32 __user *)arg)->iso_frame_desc, arg);
++	return proc_do_submiturb(ps, &uurb,
++		(struct usbdevfs_iso_packet_desc __user *)uurb.iso_frame_desc,
++		arg);
+ }
+ 
+ static int processcompl_compat(struct async *as, void __user * __user *arg)