1 files changed, 6 insertions, 2 deletions

diff --git a/fs/coda/psdev.c b/fs/coda/psdev.c
index 241f7e04ad04..b4da2812499e 100644
--- a/fs/coda/psdev.c
+++ b/fs/coda/psdev.c
@@ -100,8 +100,12 @@ static ssize_t coda_psdev_write(struct file *file, const char __user *buf,
         ssize_t retval = 0, count = 0;
         int error;
 
+        /* make sure there is enough to copy out the (opcode, unique) values */
+        if (nbytes < (2 * sizeof(u_int32_t)))
+                return -EINVAL;
+
         /* Peek at the opcode, uniquefier */
-        if (copy_from_user(&hdr, buf, 2 * sizeof(u_long)))
+        if (copy_from_user(&hdr, buf, 2 * sizeof(u_int32_t)))
                 return -EFAULT;
 
         if (DOWNCALL(hdr.opcode)) {
@@ -127,7 +131,7 @@ static ssize_t coda_psdev_write(struct file *file, const char __user *buf,
                 }
 
                 /* what downcall errors does Venus handle ? */
-                error = coda_downcall(vcp, hdr.opcode, dcbuf);
+                error = coda_downcall(vcp, hdr.opcode, dcbuf, nbytes);
 
                 CODA_FREE(dcbuf, nbytes);
                 if (error) {