aboutsummaryrefslogtreecommitdiffstats
path: root/drivers/xen/privcmd.c
diff options
context:
space:
mode:
Diffstat (limited to 'drivers/xen/privcmd.c')
-rw-r--r--drivers/xen/privcmd.c6
1 files changed, 3 insertions, 3 deletions
diff --git a/drivers/xen/privcmd.c b/drivers/xen/privcmd.c
index 7e6e682104dc..b24ddac1604b 100644
--- a/drivers/xen/privcmd.c
+++ b/drivers/xen/privcmd.c
@@ -459,14 +459,14 @@ static long privcmd_ioctl_mmap_batch(
459 return -EFAULT; 459 return -EFAULT;
460 /* Returns per-frame error in m.arr. */ 460 /* Returns per-frame error in m.arr. */
461 m.err = NULL; 461 m.err = NULL;
462 if (!access_ok(VERIFY_WRITE, m.arr, m.num * sizeof(*m.arr))) 462 if (!access_ok(m.arr, m.num * sizeof(*m.arr)))
463 return -EFAULT; 463 return -EFAULT;
464 break; 464 break;
465 case 2: 465 case 2:
466 if (copy_from_user(&m, udata, sizeof(struct privcmd_mmapbatch_v2))) 466 if (copy_from_user(&m, udata, sizeof(struct privcmd_mmapbatch_v2)))
467 return -EFAULT; 467 return -EFAULT;
468 /* Returns per-frame error code in m.err. */ 468 /* Returns per-frame error code in m.err. */
469 if (!access_ok(VERIFY_WRITE, m.err, m.num * (sizeof(*m.err)))) 469 if (!access_ok(m.err, m.num * (sizeof(*m.err))))
470 return -EFAULT; 470 return -EFAULT;
471 break; 471 break;
472 default: 472 default:
@@ -661,7 +661,7 @@ static long privcmd_ioctl_dm_op(struct file *file, void __user *udata)
661 goto out; 661 goto out;
662 } 662 }
663 663
664 if (!access_ok(VERIFY_WRITE, kbufs[i].uptr, 664 if (!access_ok(kbufs[i].uptr,
665 kbufs[i].size)) { 665 kbufs[i].size)) {
666 rc = -EFAULT; 666 rc = -EFAULT;
667 goto out; 667 goto out;