Commit f4a4c86b authored by Alexander Viro's avatar Alexander Viro Committed by Linus Torvalds

[PATCH] isdn_writebuf_stub() sanitized

isdn_writebuf_stub() was always called for userland pointers.

Killed the argument telling whether it's kernel or userland pointer,
killed dead code, updated callers.
parent 1d9086ac
......@@ -1072,7 +1072,7 @@ isdn_write(struct file *file, const char *buf, size_t count, loff_t * off)
goto out;
}
chidx = isdn_minor2chan(minor);
while (isdn_writebuf_stub(drvidx, chidx, buf, count, 1) != count)
while (isdn_writebuf_stub(drvidx, chidx, buf, count) != count)
interruptible_sleep_on(&dev->drv[drvidx]->snd_waitq[chidx]);
retval = count;
goto out;
......@@ -1838,8 +1838,7 @@ isdn_unexclusive_channel(int di, int ch)
* writebuf replacement for SKB_ABLE drivers
*/
static int
isdn_writebuf_stub(int drvidx, int chan, const u_char * buf, int len,
int user)
isdn_writebuf_stub(int drvidx, int chan, const u_char __user * buf, int len)
{
int ret;
int hl = dev->drv[drvidx]->interface->hl_hdrlen;
......@@ -1848,10 +1847,7 @@ isdn_writebuf_stub(int drvidx, int chan, const u_char * buf, int len,
if (!skb)
return 0;
skb_reserve(skb, hl);
if (user)
copy_from_user(skb_put(skb, len), buf, len);
else
memcpy(skb_put(skb, len), buf, len);
copy_from_user(skb_put(skb, len), buf, len);
ret = dev->drv[drvidx]->interface->writebuf_skb(drvidx, chan, 1, skb);
if (ret <= 0)
dev_kfree_skb(skb);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment