2 files changed, 9 insertions, 14 deletions

diff --git a/sound/usb/usx2y/us122l.c b/sound/usb/usx2y/us122l.c
index 98276aafefe..012ff1f6f8a 100644
--- a/sound/usb/usx2y/us122l.c
+++ b/sound/usb/usx2y/us122l.c
@@ -349,14 +349,10 @@ static int usb_stream_hwdep_ioctl(struct snd_hwdep *hw, struct file *file,
         if (cmd != SNDRV_USB_STREAM_IOCTL_SET_PARAMS)
                 return -ENOTTY;
 
-        cfg = kmalloc(sizeof(*cfg), GFP_KERNEL);
-        if (!cfg)
-                return -ENOMEM;
+        cfg = memdup_user((void *)arg, sizeof(*cfg));
+        if (IS_ERR(cfg))
+                return PTR_ERR(cfg);
 
-        if (copy_from_user(cfg, (void *)arg, sizeof(*cfg))) {
-                err = -EFAULT;
-                goto free;
-        }
         if (cfg->version != USB_STREAM_INTERFACE_VERSION) {
                 err = -ENXIO;
                 goto free;
diff --git a/sound/usb/usx2y/usX2Yhwdep.c b/sound/usb/usx2y/usX2Yhwdep.c
index 4af8740db71..f3d8f71265d 100644
--- a/sound/usb/usx2y/usX2Yhwdep.c
+++ b/sound/usb/usx2y/usX2Yhwdep.c
@@ -203,13 +203,12 @@ static int snd_usX2Y_hwdep_dsp_load(struct snd_hwdep *hw,
 
         if (access_ok(VERIFY_READ, dsp->image, dsp->length)) {
                 struct usb_device* dev = priv->chip.dev;
-                char *buf = kmalloc(dsp->length, GFP_KERNEL);
-                if (!buf)
-                        return -ENOMEM;
-                if (copy_from_user(buf, dsp->image, dsp->length)) {
-                        kfree(buf);
-                        return -EFAULT;
-                }
+                char *buf;
+
+                buf = memdup_user(dsp->image, dsp->length);
+                if (IS_ERR(buf))
+                        return PTR_ERR(buf);
+
                 err = usb_set_interface(dev, 0, 1);
                 if (err)
                         snd_printk(KERN_ERR "usb_set_interface error \n");