Commit d4a4683c authored by Greg KH's avatar Greg KH Committed by Greg Kroah-Hartman

USB: usbfs: only copy the actual data received

We need to only copy the data received by the device to userspace, not
the whole kernel buffer, which can contain "stale" data.

Thanks to Marcus Meissner for pointing this out and testing the fix.
Reported-by: default avatarMarcus Meissner <meissner@suse.de>
Tested-by: default avatarMarcus Meissner <meissner@suse.de>
Cc: Alan Stern <stern@rowland.harvard.edu>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: stable <stable@kernel.org>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@suse.de>
parent 0813e22d
...@@ -1312,9 +1312,9 @@ static int processcompl(struct async *as, void __user * __user *arg) ...@@ -1312,9 +1312,9 @@ static int processcompl(struct async *as, void __user * __user *arg)
void __user *addr = as->userurb; void __user *addr = as->userurb;
unsigned int i; unsigned int i;
if (as->userbuffer) if (as->userbuffer && urb->actual_length)
if (copy_to_user(as->userbuffer, urb->transfer_buffer, if (copy_to_user(as->userbuffer, urb->transfer_buffer,
urb->transfer_buffer_length)) urb->actual_length))
goto err_out; goto err_out;
if (put_user(as->status, &userurb->status)) if (put_user(as->status, &userurb->status))
goto err_out; goto err_out;
...@@ -1475,9 +1475,9 @@ static int processcompl_compat(struct async *as, void __user * __user *arg) ...@@ -1475,9 +1475,9 @@ static int processcompl_compat(struct async *as, void __user * __user *arg)
void __user *addr = as->userurb; void __user *addr = as->userurb;
unsigned int i; unsigned int i;
if (as->userbuffer) if (as->userbuffer && urb->actual_length)
if (copy_to_user(as->userbuffer, urb->transfer_buffer, if (copy_to_user(as->userbuffer, urb->transfer_buffer,
urb->transfer_buffer_length)) urb->actual_length))
return -EFAULT; return -EFAULT;
if (put_user(as->status, &userurb->status)) if (put_user(as->status, &userurb->status))
return -EFAULT; return -EFAULT;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment