Techwizz/kernel-fxtec-pro1x
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

[PATCH] drivers/isdn/sc/ioctl.c: copy_from_user() size fix

Browse source 
A few lines above the patch we have:

	char *srec;
	srec = kmalloc(SCIOC_SRECSIZE, GFP_KERNEL);

sizeof pointer is probably not meant here.

Signed-off-by: Domen Puncer <domen@coderock.org>
Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com>
Cc: Karsten Keil <kkeil@suse.de>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
This commit is contained in:
Domen Puncer 2006-02-03 03:04:14 -08:00 committed by Linus Torvalds
parent 74adb52797
commit abffa7da99
1 changed files with 2 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
drivers/isdn/sc/ioctl.c
View file

@ -71,14 +71,14 @@ int sc_ioctl(int card, scs_ioctl *data)
/* /*
* Get the SRec from user space * Get the SRec from user space
*/ */
if (copy_from_user(srec, data->dataptr, sizeof(srec))) { if (copy_from_user(srec, data->dataptr, SCIOC_SRECSIZE)) {
kfree(rcvmsg); kfree(rcvmsg);
kfree(srec); kfree(srec);
return -EFAULT; return -EFAULT;
} }
status = send_and_receive(card, CMPID, cmReqType2, cmReqClass0, cmReqLoadProc, status = send_and_receive(card, CMPID, cmReqType2, cmReqClass0, cmReqLoadProc,
0, sizeof(srec), srec, rcvmsg, SAR_TIMEOUT); 0, SCIOC_SRECSIZE, srec, rcvmsg, SAR_TIMEOUT);
kfree(rcvmsg); kfree(rcvmsg);
kfree(srec); kfree(srec);