diff options
| author | Linus Torvalds <torvalds@linux-foundation.org> | 2012-10-10 19:52:04 -0400 |
|---|---|---|
| committer | Linus Torvalds <torvalds@linux-foundation.org> | 2012-10-10 19:52:04 -0400 |
| commit | ba0a5a36f60e4c1152af3a2ae2813251974405bf (patch) | |
| tree | 00dd9d969b638e229eafe01fcee25b6b6b0e0080 | |
| parent | 3dddebe059d81a39aa1135b6e6d18ebfa4d25384 (diff) | |
| parent | 790198f74c9d1b46b6a89504361b1a844670d050 (diff) | |
Merge tag 'firewire-fix' of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394
Pull a firewire fix from Stefan Richter:
"Fixes an old bug of the /dev/fw* ioctl ABI."
* tag 'firewire-fix' of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394:
firewire: cdev: fix user memory corruption (i386 userland on amd64 kernel)
| -rw-r--r-- | drivers/firewire/core-cdev.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/drivers/firewire/core-cdev.c b/drivers/firewire/core-cdev.c index 2783f69dada6..f8d22872d753 100644 --- a/drivers/firewire/core-cdev.c +++ b/drivers/firewire/core-cdev.c | |||
| @@ -473,8 +473,8 @@ static int ioctl_get_info(struct client *client, union ioctl_arg *arg) | |||
| 473 | client->bus_reset_closure = a->bus_reset_closure; | 473 | client->bus_reset_closure = a->bus_reset_closure; |
| 474 | if (a->bus_reset != 0) { | 474 | if (a->bus_reset != 0) { |
| 475 | fill_bus_reset_event(&bus_reset, client); | 475 | fill_bus_reset_event(&bus_reset, client); |
| 476 | ret = copy_to_user(u64_to_uptr(a->bus_reset), | 476 | /* unaligned size of bus_reset is 36 bytes */ |
| 477 | &bus_reset, sizeof(bus_reset)); | 477 | ret = copy_to_user(u64_to_uptr(a->bus_reset), &bus_reset, 36); |
| 478 | } | 478 | } |
| 479 | if (ret == 0 && list_empty(&client->link)) | 479 | if (ret == 0 && list_empty(&client->link)) |
| 480 | list_add_tail(&client->link, &client->device->client_list); | 480 | list_add_tail(&client->link, &client->device->client_list); |