[linux-usb-devel] [PATCH] USB Digi copy_to_user bug fix

[Greg KH]

Hi,

Here's a patch from Al Borchers to fix the copy_*_user bug that Dawson
Engler found in the digi_acceleport driver.  It is against 2.4.3-pre4.

thanks,

greg k-h

-- 
greg@(kroah|wirex).com

diff -Naur -X dontdiff linux-2.4.3-pre4/drivers/usb/serial/digi_acceleport.c 
linux-2.4.3-pre4-greg/drivers/usb/serial/digi_acceleport.c
--- linux-2.4.3-pre4/drivers/usb/serial/digi_acceleport.c       Thu Feb 22 23:43:26 
2001
+++ linux-2.4.3-pre4-greg/drivers/usb/serial/digi_acceleport.c  Fri Mar 16 17:56:34 
+2001
@@ -1282,12 +1282,10 @@
        || priv->dp_write_urb_in_use ) {
 
                /* buffer data if count is 1 (probably put_char) if possible */
-               if( count == 1 ) {
-                       new_len = MIN( count,
-                               DIGI_OUT_BUF_SIZE-priv->dp_out_buf_len );
-                       memcpy( priv->dp_out_buf+priv->dp_out_buf_len, buf,
-                               new_len );
-                       priv->dp_out_buf_len += new_len;
+               if( count == 1 && priv->dp_out_buf_len < DIGI_OUT_BUF_SIZE ) {
+                       priv->dp_out_buf[priv->dp_out_buf_len++]
+                               = *(from_user ? user_buf : buf);
+                       new_len = 1;
                } else {
                        new_len = 0;
                }