Minki/linux
1
0
Fork 1
mirror of https://github.com/torvalds/linux.git synced 2024-11-11 14:42:24 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fixes an old bug of the /dev/fw* ioctl ABI.

Browse Source 
-----BEGIN PGP SIGNATURE-----
 Version: GnuPG v2.0.19 (GNU/Linux)
 
 iQIcBAABAgAGBQJQdcBcAAoJEHnzb7JUXXnQ3xcQAIOQLPz5UpbdRVyedzSymNs8
 5cwNLAO9snG2lQ/XYiMIegh/j9Cc65m/GVeHBIwP0nX2+IH6JvWh60n5Aa3CE+OP
 I/QHwTRTZSgVfJ/Z0UgWd78cd0fI2dA1YcumzLElFGTWJZaLr+5pvRD67AkYajBR
 GXXkgFhPghZ7rtKnq2wn+JtJfxLntuM+U04wkx4439A0i4LcFXoaItcb44pjb8CZ
 O//udXWlHrk4gwZ2CSvb19CFMLlVDgq++uCwQ4yOR4x4DxbqF/UYlCmZBs0KoYdS
 X52YrN4x0SnGm09+QKFgHr8qzHDaRCpph2Ox2ThBsVuoIGpiad8SXROKIN1+p+OO
 9eqK23FIIEiaFgP8zs2lVfuTDzWg8foDlCz+RPCg6djjIUzlwYuHF3TU/5E3K0sa
 vdcYQxzPSkYGvJ9VBe0Xkk6icLW7AfZw6PDsh+P4VxOZDe8nIuCZoZjoJJ9lxuta
 CXzSGuTasEzc/fDgoxYzVwjg6N8rv/jkOKSVdP148XvRxH8YzfItekYHnxXTWmZZ
 4tFX82B//4Zp5xIfGmqSMi2xw/qePDVPeERhN4YLZls6Qz6x222T5gAPbAZ9/z/N
 xqdHIomQ6PHLWsVr4Xa9emP9AdV2ZYuYHyHRjXzu0NhHJgb/13v6nw6KL/IeTUwa
 b8kLe4g6ch8Lp7VCH7K/
 =arYK
 -----END PGP SIGNATURE-----

Merge tag 'firewire-fix' of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394

Pull a firewire fix from Stefan Richter:
 "Fixes an old bug of the /dev/fw* ioctl ABI."

* tag 'firewire-fix' of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394:
  firewire: cdev: fix user memory corruption (i386 userland on amd64 kernel)
This commit is contained in:
Linus Torvalds 2012-10-11 08:52:04 +09:00
commit ba0a5a36f6
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
drivers/firewire/core-cdev.c
View File

@ -473,8 +473,8 @@ static int ioctl_get_info(struct client *client, union ioctl_arg *arg)
client->bus_reset_closure = a->bus_reset_closure;
if (a->bus_reset != 0) {
fill_bus_reset_event(&bus_reset, client);
ret = copy_to_user(u64_to_uptr(a->bus_reset),
&bus_reset, sizeof(bus_reset));
/* unaligned size of bus_reset is 36 bytes */
ret = copy_to_user(u64_to_uptr(a->bus_reset), &bus_reset, 36);
}
if (ret == 0 && list_empty(&client->link))
list_add_tail(&client->link, &client->device->client_list);