Merge commit 'v2.6.29-rc1' into core/urgent

1 files changed, 5 insertions, 1 deletions

diff --git a/drivers/mtd/mtdchar.c b/drivers/mtd/mtdchar.c
index bcffeda2df3d..e9ec59e9a566 100644
--- a/drivers/mtd/mtdchar.c
+++ b/drivers/mtd/mtdchar.c
@@ -450,16 +450,20 @@ static int mtd_ioctl(struct inode *inode, struct file *file,
                 if (!erase)
                         ret = -ENOMEM;
                 else {
+                        struct erase_info_user einfo;
+
                         wait_queue_head_t waitq;
                         DECLARE_WAITQUEUE(wait, current);
 
                         init_waitqueue_head(&waitq);
 
-                        if (copy_from_user(&erase->addr, argp,
+                        if (copy_from_user(&einfo, argp,
                                     sizeof(struct erase_info_user))) {
                                 kfree(erase);
                                 return -EFAULT;
                         }
+                        erase->addr = einfo.start;
+                        erase->len = einfo.length;
                         erase->mtd = mtd;
                         erase->callback = mtdchar_erase_callback;
                         erase->priv = (unsigned long)&waitq;