From abffa7da99b78caaf81a2f519bf9cbd1e8dcbc1d Mon Sep 17 00:00:00 2001 From: Domen Puncer Date: Fri, 3 Feb 2006 03:04:14 -0800 Subject: [PATCH] drivers/isdn/sc/ioctl.c: copy_from_user() size fix A few lines above the patch we have: char *srec; srec = kmalloc(SCIOC_SRECSIZE, GFP_KERNEL); sizeof pointer is probably not meant here. Signed-off-by: Domen Puncer Signed-off-by: Alexey Dobriyan Cc: Karsten Keil Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds --- drivers/isdn/sc/ioctl.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'drivers/isdn') diff --git a/drivers/isdn/sc/ioctl.c b/drivers/isdn/sc/ioctl.c index 3314a5a..94c9afb 100644 --- a/drivers/isdn/sc/ioctl.c +++ b/drivers/isdn/sc/ioctl.c @@ -71,14 +71,14 @@ int sc_ioctl(int card, scs_ioctl *data) /* * Get the SRec from user space */ - if (copy_from_user(srec, data->dataptr, sizeof(srec))) { + if (copy_from_user(srec, data->dataptr, SCIOC_SRECSIZE)) { kfree(rcvmsg); kfree(srec); return -EFAULT; } status = send_and_receive(card, CMPID, cmReqType2, cmReqClass0, cmReqLoadProc, - 0, sizeof(srec), srec, rcvmsg, SAR_TIMEOUT); + 0, SCIOC_SRECSIZE, srec, rcvmsg, SAR_TIMEOUT); kfree(rcvmsg); kfree(srec); -- cgit v1.1