1 files changed, 23 insertions, 13 deletions

diff --git a/fs/coda/psdev.c b/fs/coda/psdev.c
index 0ceef32e6fae..240669f51eac 100644
--- a/fs/coda/psdev.c
+++ b/fs/coda/psdev.c
@@ -38,8 +38,7 @@
 #include <linux/uaccess.h>
 
 #include <linux/coda.h>
-#include <linux/coda_psdev.h>
-
+#include "coda_psdev.h"
 #include "coda_linux.h"
 
 #include "coda_int.h"
@@ -100,8 +99,12 @@ static ssize_t coda_psdev_write(struct file *file, const char __user *buf,
         ssize_t retval = 0, count = 0;
         int error;
 
+        /* make sure there is enough to copy out the (opcode, unique) values */
+        if (nbytes < (2 * sizeof(u_int32_t)))
+                return -EINVAL;
+
         /* Peek at the opcode, uniquefier */
-        if (copy_from_user(&hdr, buf, 2 * sizeof(u_long)))
+        if (copy_from_user(&hdr, buf, 2 * sizeof(u_int32_t)))
                 return -EFAULT;
 
         if (DOWNCALL(hdr.opcode)) {
@@ -119,17 +122,21 @@ static ssize_t coda_psdev_write(struct file *file, const char __user *buf,
                                 hdr.opcode, hdr.unique);
                         nbytes = size;
                 }
-                CODA_ALLOC(dcbuf, union outputArgs *, nbytes);
+                dcbuf = kvmalloc(nbytes, GFP_KERNEL);
+                if (!dcbuf) {
+                        retval = -ENOMEM;
+                        goto out;
+                }
                 if (copy_from_user(dcbuf, buf, nbytes)) {
-                        CODA_FREE(dcbuf, nbytes);
+                        kvfree(dcbuf);
                         retval = -EFAULT;
                         goto out;
                 }
 
                 /* what downcall errors does Venus handle ? */
-                error = coda_downcall(vcp, hdr.opcode, dcbuf);
+                error = coda_downcall(vcp, hdr.opcode, dcbuf, nbytes);
 
-                CODA_FREE(dcbuf, nbytes);
+                kvfree(dcbuf);
                 if (error) {
                         pr_warn("%s: coda_downcall error: %d\n",
                                 __func__, error);
@@ -182,8 +189,11 @@ static ssize_t coda_psdev_write(struct file *file, const char __user *buf,
         if (req->uc_opcode == CODA_OPEN_BY_FD) {
                 struct coda_open_by_fd_out *outp =
                         (struct coda_open_by_fd_out *)req->uc_data;
-                if (!outp->oh.result)
+                if (!outp->oh.result) {
                         outp->fh = fget(outp->fd);
+                        if (!outp->fh)
+                                return -EBADF;
+                }
         }
 
         wake_up(&req->uc_sleep);
@@ -252,7 +262,7 @@ static ssize_t coda_psdev_read(struct file * file, char __user * buf,
                 goto out;
         }
 
-        CODA_FREE(req->uc_data, sizeof(struct coda_in_hdr));
+        kvfree(req->uc_data);
         kfree(req);
 out:
         mutex_unlock(&vcp->vc_mutex);
@@ -314,7 +324,7 @@ static int coda_psdev_release(struct inode * inode, struct file * file)
 
                 /* Async requests need to be freed here */
                 if (req->uc_flags & CODA_REQ_ASYNC) {
-                        CODA_FREE(req->uc_data, sizeof(struct coda_in_hdr));
+                        kvfree(req->uc_data);
                         kfree(req);
                         continue;
                 }
@@ -347,13 +357,13 @@ static const struct file_operations coda_psdev_fops = {
         .llseek         = noop_llseek,
 };
 
-static int init_coda_psdev(void)
+static int __init init_coda_psdev(void)
 {
         int i, err = 0;
         if (register_chrdev(CODA_PSDEV_MAJOR, "coda", &coda_psdev_fops)) {
                 pr_err("%s: unable to get major %d\n",
                        __func__, CODA_PSDEV_MAJOR);
-              return -EIO;
+                return -EIO;
         }
         coda_psdev_class = class_create(THIS_MODULE, "coda");
         if (IS_ERR(coda_psdev_class)) {
@@ -378,7 +388,7 @@ MODULE_AUTHOR("Jan Harkes, Peter J. Braam");
 MODULE_DESCRIPTION("Coda Distributed File System VFS interface");
 MODULE_ALIAS_CHARDEV_MAJOR(CODA_PSDEV_MAJOR);
 MODULE_LICENSE("GPL");
-MODULE_VERSION("6.6");
+MODULE_VERSION("7.0");
 
 static int __init init_coda(void)
 {