From 64d65872f96e2a754caa12ef48949c314384bd9f Mon Sep 17 00:00:00 2001 From: Alan Stern Date: Fri, 18 Jun 2010 10:16:33 -0400 Subject: [PATCH] USB: fix oops in usb_sg_init() This patch (as1401) fixes a bug in usb_sg_init() that can cause an invalid pointer dereference. An inner loop reuses some local variables in an unsafe manner, so new variables are introduced. Signed-off-by: Alan Stern Tested-by: Ajay Kumar Gupta Signed-off-by: Greg Kroah-Hartman --- drivers/usb/core/message.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/drivers/usb/core/message.c b/drivers/usb/core/message.c index a73e08fdab36..fd4c36ea5e46 100644 --- a/drivers/usb/core/message.c +++ b/drivers/usb/core/message.c @@ -416,8 +416,11 @@ int usb_sg_init(struct usb_sg_request *io, struct usb_device *dev, /* A length of zero means transfer the whole sg list */ len = length; if (len == 0) { - for_each_sg(sg, sg, nents, i) - len += sg->length; + struct scatterlist *sg2; + int j; + + for_each_sg(sg, sg2, nents, j) + len += sg2->length; } } else { /*