Commit 5ffa6d7f authored by Al Viro's avatar Al Viro Committed by Jeff Garzik

wan/farsync: copy_from_user() to iomem is wrong

kmalloc intermediate buffer(), do copy_from_user() + memcpy_toio()
Signed-off-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
Signed-off-by: default avatarJeff Garzik <jeff@garzik.org>
parent ed773b4a
......@@ -2024,6 +2024,7 @@ fst_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
struct fstioc_write wrthdr;
struct fstioc_info info;
unsigned long flags;
void *buf;
dbg(DBG_IOCTL, "ioctl: %x, %p\n", cmd, ifr->ifr_data);
......@@ -2065,16 +2066,22 @@ fst_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
return -ENXIO;
}
/* Now copy the data to the card.
* This will probably break on some architectures.
* I'll fix it when I have something to test on.
*/
if (copy_from_user(card->mem + wrthdr.offset,
/* Now copy the data to the card. */
buf = kmalloc(wrthdr.size, GFP_KERNEL);
if (!buf)
return -ENOMEM;
if (copy_from_user(buf,
ifr->ifr_data + sizeof (struct fstioc_write),
wrthdr.size)) {
kfree(buf);
return -EFAULT;
}
memcpy_toio(card->mem + wrthdr.offset, buf, wrthdr.size);
kfree(buf);
/* Writes to the memory of a card in the reset state constitute
* a download
*/
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment