korg/linux
0
0
Fork 0
mirror of https://mirrors.bfsu.edu.cn/git/linux.git synced 2024-12-03 09:04:21 +08:00
Code Issues Packages Projects Releases Wiki Activity

[PATCH] drivers/isdn/sc/ioctl.c: copy_from_user() size fix

Browse Source 
A few lines above the patch we have:

	char *srec;
	srec = kmalloc(SCIOC_SRECSIZE, GFP_KERNEL);

sizeof pointer is probably not meant here.

Signed-off-by: Domen Puncer <domen@coderock.org>
Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com>
Cc: Karsten Keil <kkeil@suse.de>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
This commit is contained in:
Domen Puncer 2006-02-03 03:04:14 -08:00 committed by Linus Torvalds
parent 74adb52797
commit abffa7da99
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
drivers/isdn/sc/ioctl.c
View File

@ -71,14 +71,14 @@ int sc_ioctl(int card, scs_ioctl *data)
/*
* Get the SRec from user space
*/
if (copy_from_user(srec, data->dataptr, sizeof(srec))) {
if (copy_from_user(srec, data->dataptr, SCIOC_SRECSIZE)) {
kfree(rcvmsg);
kfree(srec);
return -EFAULT;
}
status = send_and_receive(card, CMPID, cmReqType2, cmReqClass0, cmReqLoadProc,
0, sizeof(srec), srec, rcvmsg, SAR_TIMEOUT);
0, SCIOC_SRECSIZE, srec, rcvmsg, SAR_TIMEOUT);
kfree(rcvmsg);
kfree(srec);