Commit abffa7da authored by Domen Puncer's avatar Domen Puncer Committed by Linus Torvalds

[PATCH] drivers/isdn/sc/ioctl.c: copy_from_user() size fix

A few lines above the patch we have:

	char *srec;
	srec = kmalloc(SCIOC_SRECSIZE, GFP_KERNEL);

sizeof pointer is probably not meant here.
Signed-off-by: default avatarDomen Puncer <domen@coderock.org>
Signed-off-by: default avatarAlexey Dobriyan <adobriyan@gmail.com>
Cc: Karsten Keil <kkeil@suse.de>
Signed-off-by: default avatarAndrew Morton <akpm@osdl.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@osdl.org>
parent 74adb527
...@@ -71,14 +71,14 @@ int sc_ioctl(int card, scs_ioctl *data) ...@@ -71,14 +71,14 @@ int sc_ioctl(int card, scs_ioctl *data)
/* /*
* Get the SRec from user space * Get the SRec from user space
*/ */
if (copy_from_user(srec, data->dataptr, sizeof(srec))) { if (copy_from_user(srec, data->dataptr, SCIOC_SRECSIZE)) {
kfree(rcvmsg); kfree(rcvmsg);
kfree(srec); kfree(srec);
return -EFAULT; return -EFAULT;
} }
status = send_and_receive(card, CMPID, cmReqType2, cmReqClass0, cmReqLoadProc, status = send_and_receive(card, CMPID, cmReqType2, cmReqClass0, cmReqLoadProc,
0, sizeof(srec), srec, rcvmsg, SAR_TIMEOUT); 0, SCIOC_SRECSIZE, srec, rcvmsg, SAR_TIMEOUT);
kfree(rcvmsg); kfree(rcvmsg);
kfree(srec); kfree(srec);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment