From: Alan Stern <stern@rowland.harvard.edu>
Date: Fri, 18 Jun 2010 14:16:33 +0000 (-0400)
Subject: USB: fix oops in usb_sg_init()
X-Git-Tag: v2.6.35-rc4~18^2~12
X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=64d65872f96e2a754caa12ef48949c314384bd9f;p=platform%2Fkernel%2Flinux-3.10.git

USB: fix oops in usb_sg_init()

This patch (as1401) fixes a bug in usb_sg_init() that can cause an
invalid pointer dereference.  An inner loop reuses some local variables
in an unsafe manner, so new variables are introduced.

Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Tested-by: Ajay Kumar Gupta <ajay.gupta@ti.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---

diff --git a/drivers/usb/core/message.c b/drivers/usb/core/message.c
index a73e08f..fd4c36e 100644
--- a/drivers/usb/core/message.c
+++ b/drivers/usb/core/message.c
@@ -416,8 +416,11 @@ int usb_sg_init(struct usb_sg_request *io, struct usb_device *dev,
 			/* A length of zero means transfer the whole sg list */
 			len = length;
 			if (len == 0) {
-				for_each_sg(sg, sg, nents, i)
-					len += sg->length;
+				struct scatterlist	*sg2;
+				int			j;
+
+				for_each_sg(sg, sg2, nents, j)
+					len += sg2->length;
 			}
 		} else {
 			/*