diff options
Diffstat (limited to 'drivers/xen/privcmd.c')
-rw-r--r-- | drivers/xen/privcmd.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/drivers/xen/privcmd.c b/drivers/xen/privcmd.c index 7e6e682104dc..b24ddac1604b 100644 --- a/drivers/xen/privcmd.c +++ b/drivers/xen/privcmd.c | |||
@@ -459,14 +459,14 @@ static long privcmd_ioctl_mmap_batch( | |||
459 | return -EFAULT; | 459 | return -EFAULT; |
460 | /* Returns per-frame error in m.arr. */ | 460 | /* Returns per-frame error in m.arr. */ |
461 | m.err = NULL; | 461 | m.err = NULL; |
462 | if (!access_ok(VERIFY_WRITE, m.arr, m.num * sizeof(*m.arr))) | 462 | if (!access_ok(m.arr, m.num * sizeof(*m.arr))) |
463 | return -EFAULT; | 463 | return -EFAULT; |
464 | break; | 464 | break; |
465 | case 2: | 465 | case 2: |
466 | if (copy_from_user(&m, udata, sizeof(struct privcmd_mmapbatch_v2))) | 466 | if (copy_from_user(&m, udata, sizeof(struct privcmd_mmapbatch_v2))) |
467 | return -EFAULT; | 467 | return -EFAULT; |
468 | /* Returns per-frame error code in m.err. */ | 468 | /* Returns per-frame error code in m.err. */ |
469 | if (!access_ok(VERIFY_WRITE, m.err, m.num * (sizeof(*m.err)))) | 469 | if (!access_ok(m.err, m.num * (sizeof(*m.err)))) |
470 | return -EFAULT; | 470 | return -EFAULT; |
471 | break; | 471 | break; |
472 | default: | 472 | default: |
@@ -661,7 +661,7 @@ static long privcmd_ioctl_dm_op(struct file *file, void __user *udata) | |||
661 | goto out; | 661 | goto out; |
662 | } | 662 | } |
663 | 663 | ||
664 | if (!access_ok(VERIFY_WRITE, kbufs[i].uptr, | 664 | if (!access_ok(kbufs[i].uptr, |
665 | kbufs[i].size)) { | 665 | kbufs[i].size)) { |
666 | rc = -EFAULT; | 666 | rc = -EFAULT; |
667 | goto out; | 667 | goto out; |