aboutsummaryrefslogtreecommitdiffstats
path: root/drivers/usb/core/devio.c
diff options
context:
space:
mode:
Diffstat (limited to 'drivers/usb/core/devio.c')
-rw-r--r--drivers/usb/core/devio.c7
1 files changed, 3 insertions, 4 deletions
diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c
index a75bc0b8a50f..d65566341dd1 100644
--- a/drivers/usb/core/devio.c
+++ b/drivers/usb/core/devio.c
@@ -1094,7 +1094,7 @@ static int proc_control(struct usb_dev_state *ps, void __user *arg)
1094 ctrl.bRequestType, ctrl.bRequest, ctrl.wValue, 1094 ctrl.bRequestType, ctrl.bRequest, ctrl.wValue,
1095 ctrl.wIndex, ctrl.wLength); 1095 ctrl.wIndex, ctrl.wLength);
1096 if (ctrl.bRequestType & 0x80) { 1096 if (ctrl.bRequestType & 0x80) {
1097 if (ctrl.wLength && !access_ok(VERIFY_WRITE, ctrl.data, 1097 if (ctrl.wLength && !access_ok(ctrl.data,
1098 ctrl.wLength)) { 1098 ctrl.wLength)) {
1099 ret = -EINVAL; 1099 ret = -EINVAL;
1100 goto done; 1100 goto done;
@@ -1183,7 +1183,7 @@ static int proc_bulk(struct usb_dev_state *ps, void __user *arg)
1183 } 1183 }
1184 tmo = bulk.timeout; 1184 tmo = bulk.timeout;
1185 if (bulk.ep & 0x80) { 1185 if (bulk.ep & 0x80) {
1186 if (len1 && !access_ok(VERIFY_WRITE, bulk.data, len1)) { 1186 if (len1 && !access_ok(bulk.data, len1)) {
1187 ret = -EINVAL; 1187 ret = -EINVAL;
1188 goto done; 1188 goto done;
1189 } 1189 }
@@ -1584,8 +1584,7 @@ static int proc_do_submiturb(struct usb_dev_state *ps, struct usbdevfs_urb *uurb
1584 } 1584 }
1585 1585
1586 if (uurb->buffer_length > 0 && 1586 if (uurb->buffer_length > 0 &&
1587 !access_ok(is_in ? VERIFY_WRITE : VERIFY_READ, 1587 !access_ok(uurb->buffer, uurb->buffer_length)) {
1588 uurb->buffer, uurb->buffer_length)) {
1589 ret = -EFAULT; 1588 ret = -EFAULT;
1590 goto error; 1589 goto error;
1591 } 1590 }