[PATCH 3.2 014/140] USB: usbfs: Filter flags passed in from user space

[Ben Hutchings]

3.2.100-rc1 review patch.  If anyone has any objections, please let me know.

--

From: Oliver Neukum 

commit 446f666da9f019ce2ffd03800995487e79a91462 upstream.

USBDEVFS_URB_ISO_ASAP must be accepted only for ISO endpoints.
Improve sanity checking.

Reported-by: Andrey Konovalov 
Signed-off-by: Oliver Neukum 
Acked-by: Alan Stern 
Signed-off-by: Greg Kroah-Hartman 
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings 
---
 drivers/usb/core/devio.c | 14 +-
 1 file changed, 9 insertions(+), 5 deletions(-)

--- a/drivers/usb/core/devio.c
+++ b/drivers/usb/core/devio.c
@@ -1093,14 +1093,18 @@ static int proc_do_submiturb(struct dev_
unsigned int u, totlen, isofrmlen;
int ret, ifnum = -1;
int is_in;
-
-   if (uurb->flags & ~(USBDEVFS_URB_ISO_ASAP |
-   USBDEVFS_URB_SHORT_NOT_OK |
+   unsigned long mask =USBDEVFS_URB_SHORT_NOT_OK |
USBDEVFS_URB_BULK_CONTINUATION |
USBDEVFS_URB_NO_FSBR |
USBDEVFS_URB_ZERO_PACKET |
-   USBDEVFS_URB_NO_INTERRUPT))
-   return -EINVAL;
+   USBDEVFS_URB_NO_INTERRUPT;
+   /* USBDEVFS_URB_ISO_ASAP is a special case */
+   if (uurb->type == USBDEVFS_URB_TYPE_ISO)
+   mask |= USBDEVFS_URB_ISO_ASAP;
+
+   if (uurb->flags & ~mask)
+   return -EINVAL;
+
if (uurb->buffer_length > 0 && !uurb->buffer)
return -EINVAL;
if (!(uurb->type == USBDEVFS_URB_TYPE_CONTROL &&

[PATCH 3.2 014/140] USB: usbfs: Filter flags passed in from user space

[Ben Hutchings]

3.2.100-rc1 review patch.  If anyone has any objections, please let me know.

--

From: Oliver Neukum 

commit 446f666da9f019ce2ffd03800995487e79a91462 upstream.

USBDEVFS_URB_ISO_ASAP must be accepted only for ISO endpoints.
Improve sanity checking.

Reported-by: Andrey Konovalov 
Signed-off-by: Oliver Neukum 
Acked-by: Alan Stern 
Signed-off-by: Greg Kroah-Hartman 
[bwh: Backported to 3.2: adjust context]
Signed-off-by: Ben Hutchings 
---
 drivers/usb/core/devio.c | 14 +-
 1 file changed, 9 insertions(+), 5 deletions(-)

--- a/drivers/usb/core/devio.c
+++ b/drivers/usb/core/devio.c
@@ -1093,14 +1093,18 @@ static int proc_do_submiturb(struct dev_
unsigned int u, totlen, isofrmlen;
int ret, ifnum = -1;
int is_in;
-
-   if (uurb->flags & ~(USBDEVFS_URB_ISO_ASAP |
-   USBDEVFS_URB_SHORT_NOT_OK |
+   unsigned long mask =USBDEVFS_URB_SHORT_NOT_OK |
USBDEVFS_URB_BULK_CONTINUATION |
USBDEVFS_URB_NO_FSBR |
USBDEVFS_URB_ZERO_PACKET |
-   USBDEVFS_URB_NO_INTERRUPT))
-   return -EINVAL;
+   USBDEVFS_URB_NO_INTERRUPT;
+   /* USBDEVFS_URB_ISO_ASAP is a special case */
+   if (uurb->type == USBDEVFS_URB_TYPE_ISO)
+   mask |= USBDEVFS_URB_ISO_ASAP;
+
+   if (uurb->flags & ~mask)
+   return -EINVAL;
+
if (uurb->buffer_length > 0 && !uurb->buffer)
return -EINVAL;
if (!(uurb->type == USBDEVFS_URB_TYPE_CONTROL &&