USB: fix oops in usb_sg_init()

This patch (as1401) fixes a bug in usb_sg_init() that can cause an
invalid pointer dereference.  An inner loop reuses some local variables
in an unsafe manner, so new variables are introduced.

Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Tested-by: Ajay Kumar Gupta <ajay.gupta@ti.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

diff --git a/drivers/usb/core/message.c b/drivers/usb/core/message.c
index a73e08fdab36336fee6f14bacef1c7dd1ec58764..fd4c36ea5e4688971afc9c2f32e3668429d0ae63 100644 (file)
--- a/drivers/usb/core/message.c
+++ b/drivers/usb/core/message.c
@@ -416,8 +416,11 @@ int usb_sg_init(struct usb_sg_request *io, struct usb_device *dev,
                        /* A length of zero means transfer the whole sg list */
                        len = length;
                        if (len == 0) {
-                               for_each_sg(sg, sg, nents, i)
-                                       len += sg->length;
+                               struct scatterlist      *sg2;
+                               int                     j;
+
+                               for_each_sg(sg, sg2, nents, j)
+                                       len += sg2->length;
                        }
                } else {
                        /*