diff options
Diffstat (limited to 'drivers')
-rw-r--r-- | drivers/usb/core/devio.c | 16 |
1 files changed, 10 insertions, 6 deletions
diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c index 308609039c73..706f18156af8 100644 --- a/drivers/usb/core/devio.c +++ b/drivers/usb/core/devio.c | |||
@@ -1231,22 +1231,22 @@ static int processcompl(struct async *as, void __user * __user *arg) | |||
1231 | if (as->userbuffer) | 1231 | if (as->userbuffer) |
1232 | if (copy_to_user(as->userbuffer, urb->transfer_buffer, | 1232 | if (copy_to_user(as->userbuffer, urb->transfer_buffer, |
1233 | urb->transfer_buffer_length)) | 1233 | urb->transfer_buffer_length)) |
1234 | return -EFAULT; | 1234 | goto err_out; |
1235 | if (put_user(as->status, &userurb->status)) | 1235 | if (put_user(as->status, &userurb->status)) |
1236 | return -EFAULT; | 1236 | goto err_out; |
1237 | if (put_user(urb->actual_length, &userurb->actual_length)) | 1237 | if (put_user(urb->actual_length, &userurb->actual_length)) |
1238 | return -EFAULT; | 1238 | goto err_out; |
1239 | if (put_user(urb->error_count, &userurb->error_count)) | 1239 | if (put_user(urb->error_count, &userurb->error_count)) |
1240 | return -EFAULT; | 1240 | goto err_out; |
1241 | 1241 | ||
1242 | if (usb_endpoint_xfer_isoc(&urb->ep->desc)) { | 1242 | if (usb_endpoint_xfer_isoc(&urb->ep->desc)) { |
1243 | for (i = 0; i < urb->number_of_packets; i++) { | 1243 | for (i = 0; i < urb->number_of_packets; i++) { |
1244 | if (put_user(urb->iso_frame_desc[i].actual_length, | 1244 | if (put_user(urb->iso_frame_desc[i].actual_length, |
1245 | &userurb->iso_frame_desc[i].actual_length)) | 1245 | &userurb->iso_frame_desc[i].actual_length)) |
1246 | return -EFAULT; | 1246 | goto err_out; |
1247 | if (put_user(urb->iso_frame_desc[i].status, | 1247 | if (put_user(urb->iso_frame_desc[i].status, |
1248 | &userurb->iso_frame_desc[i].status)) | 1248 | &userurb->iso_frame_desc[i].status)) |
1249 | return -EFAULT; | 1249 | goto err_out; |
1250 | } | 1250 | } |
1251 | } | 1251 | } |
1252 | 1252 | ||
@@ -1255,6 +1255,10 @@ static int processcompl(struct async *as, void __user * __user *arg) | |||
1255 | if (put_user(addr, (void __user * __user *)arg)) | 1255 | if (put_user(addr, (void __user * __user *)arg)) |
1256 | return -EFAULT; | 1256 | return -EFAULT; |
1257 | return 0; | 1257 | return 0; |
1258 | |||
1259 | err_out: | ||
1260 | free_async(as); | ||
1261 | return -EFAULT; | ||
1258 | } | 1262 | } |
1259 | 1263 | ||
1260 | static struct async *reap_as(struct dev_state *ps) | 1264 | static struct async *reap_as(struct dev_state *ps) |