diff options
| author | Domen Puncer <domen@coderock.org> | 2006-02-03 03:04:14 -0800 |
|---|---|---|
| committer | Linus Torvalds <torvalds@g5.osdl.org> | 2006-02-03 08:32:05 -0800 |
| commit | abffa7da99b78caaf81a2f519bf9cbd1e8dcbc1d (patch) | |
| tree | f28e90613a3f01b9d867adecab778ade0c4fbf85 /drivers/isdn/sc/ioctl.c | |
| parent | 74adb52797a7cde217a8ceeaf254a5441a42a72c (diff) | |
[PATCH] drivers/isdn/sc/ioctl.c: copy_from_user() size fix
A few lines above the patch we have:
char *srec;
srec = kmalloc(SCIOC_SRECSIZE, GFP_KERNEL);
sizeof pointer is probably not meant here.
Signed-off-by: Domen Puncer <domen@coderock.org>
Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com>
Cc: Karsten Keil <kkeil@suse.de>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Diffstat (limited to 'drivers/isdn/sc/ioctl.c')
| -rw-r--r-- | drivers/isdn/sc/ioctl.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/drivers/isdn/sc/ioctl.c b/drivers/isdn/sc/ioctl.c index 3314a5a19854..94c9afb7017c 100644 --- a/drivers/isdn/sc/ioctl.c +++ b/drivers/isdn/sc/ioctl.c @@ -71,14 +71,14 @@ int sc_ioctl(int card, scs_ioctl *data) /* * Get the SRec from user space */ - if (copy_from_user(srec, data->dataptr, sizeof(srec))) { + if (copy_from_user(srec, data->dataptr, SCIOC_SRECSIZE)) { kfree(rcvmsg); kfree(srec); return -EFAULT; } status = send_and_receive(card, CMPID, cmReqType2, cmReqClass0, cmReqLoadProc, - 0, sizeof(srec), srec, rcvmsg, SAR_TIMEOUT); + 0, SCIOC_SRECSIZE, srec, rcvmsg, SAR_TIMEOUT); kfree(rcvmsg); kfree(srec); |