diff options
Diffstat (limited to 'drivers/usb/core/devio.c')
-rw-r--r-- | drivers/usb/core/devio.c | 7 |
1 files changed, 3 insertions, 4 deletions
diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c index a75bc0b8a50f..d65566341dd1 100644 --- a/drivers/usb/core/devio.c +++ b/drivers/usb/core/devio.c | |||
@@ -1094,7 +1094,7 @@ static int proc_control(struct usb_dev_state *ps, void __user *arg) | |||
1094 | ctrl.bRequestType, ctrl.bRequest, ctrl.wValue, | 1094 | ctrl.bRequestType, ctrl.bRequest, ctrl.wValue, |
1095 | ctrl.wIndex, ctrl.wLength); | 1095 | ctrl.wIndex, ctrl.wLength); |
1096 | if (ctrl.bRequestType & 0x80) { | 1096 | if (ctrl.bRequestType & 0x80) { |
1097 | if (ctrl.wLength && !access_ok(VERIFY_WRITE, ctrl.data, | 1097 | if (ctrl.wLength && !access_ok(ctrl.data, |
1098 | ctrl.wLength)) { | 1098 | ctrl.wLength)) { |
1099 | ret = -EINVAL; | 1099 | ret = -EINVAL; |
1100 | goto done; | 1100 | goto done; |
@@ -1183,7 +1183,7 @@ static int proc_bulk(struct usb_dev_state *ps, void __user *arg) | |||
1183 | } | 1183 | } |
1184 | tmo = bulk.timeout; | 1184 | tmo = bulk.timeout; |
1185 | if (bulk.ep & 0x80) { | 1185 | if (bulk.ep & 0x80) { |
1186 | if (len1 && !access_ok(VERIFY_WRITE, bulk.data, len1)) { | 1186 | if (len1 && !access_ok(bulk.data, len1)) { |
1187 | ret = -EINVAL; | 1187 | ret = -EINVAL; |
1188 | goto done; | 1188 | goto done; |
1189 | } | 1189 | } |
@@ -1584,8 +1584,7 @@ static int proc_do_submiturb(struct usb_dev_state *ps, struct usbdevfs_urb *uurb | |||
1584 | } | 1584 | } |
1585 | 1585 | ||
1586 | if (uurb->buffer_length > 0 && | 1586 | if (uurb->buffer_length > 0 && |
1587 | !access_ok(is_in ? VERIFY_WRITE : VERIFY_READ, | 1587 | !access_ok(uurb->buffer, uurb->buffer_length)) { |
1588 | uurb->buffer, uurb->buffer_length)) { | ||
1589 | ret = -EFAULT; | 1588 | ret = -EFAULT; |
1590 | goto error; | 1589 | goto error; |
1591 | } | 1590 | } |