提交 64d65872 编写于 作者: A Alan Stern 提交者: Greg Kroah-Hartman

USB: fix oops in usb_sg_init()

This patch (as1401) fixes a bug in usb_sg_init() that can cause an
invalid pointer dereference.  An inner loop reuses some local variables
in an unsafe manner, so new variables are introduced.
Signed-off-by: NAlan Stern <stern@rowland.harvard.edu>
Tested-by: NAjay Kumar Gupta <ajay.gupta@ti.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>
上级 3b49d231
......@@ -416,8 +416,11 @@ int usb_sg_init(struct usb_sg_request *io, struct usb_device *dev,
/* A length of zero means transfer the whole sg list */
len = length;
if (len == 0) {
for_each_sg(sg, sg, nents, i)
len += sg->length;
struct scatterlist *sg2;
int j;
for_each_sg(sg, sg2, nents, j)
len += sg2->length;
}
} else {
/*
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册