Revert "[PATCH] usb: drivers/usb/core/devio.c dereferences a userspace pointer" (83626b01) · Commits · 戴 / test

This reverts commit . As Al so eloquently points out, the patch is crap. The old code was fine, the new code was bogus. It never dereferenced a user pointer, the "->" operator was to an array member, which gives the _address_ of the member (in user space), not an actual dereference at all. Signed-off-by:

Linus Torvalds <torvalds@osdl.org>

drivers/usb/core/devio.c

+2 −6

Original line number	Diff line number	Diff line
		@@ -1078,9 +1078,7 @@ static int proc_submiturb(struct dev_state ps, void __user arg)
		if (copy_from_user(&uurb, arg, sizeof(uurb)))
		return -EFAULT;

		return proc_do_submiturb(ps, &uurb,
		(struct usbdevfs_iso_packet_desc __user *)uurb.iso_frame_desc,
		arg);
		return proc_do_submiturb(ps, &uurb, (((struct usbdevfs_urb __user *)arg)->iso_frame_desc), arg);
		}

		static int proc_unlinkurb(struct dev_state ps, void __user arg)
		@@ -1205,9 +1203,7 @@ static int proc_submiturb_compat(struct dev_state ps, void __user arg)
		if (get_urb32(&uurb,(struct usbdevfs_urb32 *)arg))
		return -EFAULT;

		return proc_do_submiturb(ps, &uurb,
		(struct usbdevfs_iso_packet_desc __user *)uurb.iso_frame_desc,
		arg);
		return proc_do_submiturb(ps, &uurb, ((struct usbdevfs_urb32 __user *)arg)->iso_frame_desc, arg);
		}

		static int processcompl_compat(struct async as, void __user __user *arg)

Admin message