[PATCH] usb: drivers/usb/core/devio.c dereferences a userspace pointer

[~andy/linux] / drivers / usb / core / devio.c

diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c
index df3fb57d71e608cb8d1da0a96fe2eeaa53cc718f..2eda52fc1ebc76c79093399ddfc263e8cd420d6a 100644 (file)
--- a/drivers/usb/core/devio.c
+++ b/drivers/usb/core/devio.c
@@ -1078,7 +1078,9 @@ static int proc_submiturb(struct dev_state *ps, void __user *arg)
        if (copy_from_user(&uurb, arg, sizeof(uurb)))
                return -EFAULT;
 
-       return proc_do_submiturb(ps, &uurb, (((struct usbdevfs_urb __user *)arg)->iso_frame_desc), arg);
+       return proc_do_submiturb(ps, &uurb,
+               (struct usbdevfs_iso_packet_desc __user *)uurb.iso_frame_desc,
+               arg);
 }
 
 static int proc_unlinkurb(struct dev_state *ps, void __user *arg)
@@ -1203,7 +1205,9 @@ static int proc_submiturb_compat(struct dev_state *ps, void __user *arg)
        if (get_urb32(&uurb,(struct usbdevfs_urb32 *)arg))
                return -EFAULT;
 
-       return proc_do_submiturb(ps, &uurb, ((struct usbdevfs_urb32 __user *)arg)->iso_frame_desc, arg);
+       return proc_do_submiturb(ps, &uurb,
+               (struct usbdevfs_iso_packet_desc __user *)uurb.iso_frame_desc,
+               arg);
 }
 
 static int processcompl_compat(struct async *as, void __user * __user *arg)