"req->length" is a capped version of "data->length".
Signed-off-by: Dan Carpenter <dan.carpen...@oracle.com>
---
Static analysis. I have not tested this.
diff --git a/drivers/usb/gadget/uvc_v4l2.c b/drivers/usb/gadget/uvc_v4l2.c
index 2ca9386..8770cf0 100644
--- a/drivers/usb/gadget/uvc_v4l2.c
+++ b/drivers/usb/gadget/uvc_v4l2.c
@@ -43,7 +43,7 @@ uvc_send_response(struct uvc_device *uvc, struct
uvc_request_data *data)
req->zero = data->length < uvc->event_length;
req->dma = DMA_ADDR_INVALID;
- memcpy(req->buf, data->data, data->length);
+ memcpy(req->buf, data->data, req->length);
return usb_ep_queue(cdev->gadget->ep0, req, GFP_KERNEL);
}
--
To unsubscribe from this list: send the line "unsubscribe linux-usb" in
the body of a message to majord...@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
