aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
-rw-r--r--drivers/char/amiserial.c19
1 files changed, 9 insertions, 10 deletions
diff --git a/drivers/char/amiserial.c b/drivers/char/amiserial.c
index aabb368db935..667a21c72edb 100644
--- a/drivers/char/amiserial.c
+++ b/drivers/char/amiserial.c
@@ -1089,7 +1089,7 @@ static void rs_unthrottle(struct tty_struct * tty)
1089 */ 1089 */
1090 1090
1091static int get_serial_info(struct async_struct * info, 1091static int get_serial_info(struct async_struct * info,
1092 struct serial_struct * retinfo) 1092 struct serial_struct __user * retinfo)
1093{ 1093{
1094 struct serial_struct tmp; 1094 struct serial_struct tmp;
1095 struct serial_state *state = info->state; 1095 struct serial_state *state = info->state;
@@ -1113,7 +1113,7 @@ static int get_serial_info(struct async_struct * info,
1113} 1113}
1114 1114
1115static int set_serial_info(struct async_struct * info, 1115static int set_serial_info(struct async_struct * info,
1116 struct serial_struct * new_info) 1116 struct serial_struct __user * new_info)
1117{ 1117{
1118 struct serial_struct new_serial; 1118 struct serial_struct new_serial;
1119 struct serial_state old_state, *state; 1119 struct serial_state old_state, *state;
@@ -1194,7 +1194,7 @@ check_and_exit:
1194 * transmit holding register is empty. This functionality 1194 * transmit holding register is empty. This functionality
1195 * allows an RS485 driver to be written in user space. 1195 * allows an RS485 driver to be written in user space.
1196 */ 1196 */
1197static int get_lsr_info(struct async_struct * info, unsigned int *value) 1197static int get_lsr_info(struct async_struct * info, unsigned int __user *value)
1198{ 1198{
1199 unsigned char status; 1199 unsigned char status;
1200 unsigned int result; 1200 unsigned int result;
@@ -1285,6 +1285,7 @@ static int rs_ioctl(struct tty_struct *tty, struct file * file,
1285 struct async_struct * info = (struct async_struct *)tty->driver_data; 1285 struct async_struct * info = (struct async_struct *)tty->driver_data;
1286 struct async_icount cprev, cnow; /* kernel counter temps */ 1286 struct async_icount cprev, cnow; /* kernel counter temps */
1287 struct serial_icounter_struct icount; 1287 struct serial_icounter_struct icount;
1288 void __user *argp = (void __user *)arg;
1288 unsigned long flags; 1289 unsigned long flags;
1289 1290
1290 if (serial_paranoia_check(info, tty->name, "rs_ioctl")) 1291 if (serial_paranoia_check(info, tty->name, "rs_ioctl"))
@@ -1299,19 +1300,17 @@ static int rs_ioctl(struct tty_struct *tty, struct file * file,
1299 1300
1300 switch (cmd) { 1301 switch (cmd) {
1301 case TIOCGSERIAL: 1302 case TIOCGSERIAL:
1302 return get_serial_info(info, 1303 return get_serial_info(info, argp);
1303 (struct serial_struct *) arg);
1304 case TIOCSSERIAL: 1304 case TIOCSSERIAL:
1305 return set_serial_info(info, 1305 return set_serial_info(info, argp);
1306 (struct serial_struct *) arg);
1307 case TIOCSERCONFIG: 1306 case TIOCSERCONFIG:
1308 return 0; 1307 return 0;
1309 1308
1310 case TIOCSERGETLSR: /* Get line status register */ 1309 case TIOCSERGETLSR: /* Get line status register */
1311 return get_lsr_info(info, (unsigned int *) arg); 1310 return get_lsr_info(info, argp);
1312 1311
1313 case TIOCSERGSTRUCT: 1312 case TIOCSERGSTRUCT:
1314 if (copy_to_user((struct async_struct *) arg, 1313 if (copy_to_user(argp,
1315 info, sizeof(struct async_struct))) 1314 info, sizeof(struct async_struct)))
1316 return -EFAULT; 1315 return -EFAULT;
1317 return 0; 1316 return 0;
@@ -1370,7 +1369,7 @@ static int rs_ioctl(struct tty_struct *tty, struct file * file,
1370 icount.brk = cnow.brk; 1369 icount.brk = cnow.brk;
1371 icount.buf_overrun = cnow.buf_overrun; 1370 icount.buf_overrun = cnow.buf_overrun;
1372 1371
1373 if (copy_to_user((void *)arg, &icount, sizeof(icount))) 1372 if (copy_to_user(argp, &icount, sizeof(icount)))
1374 return -EFAULT; 1373 return -EFAULT;
1375 return 0; 1374 return 0;
1376 case TIOCSERGWILD: 1375 case TIOCSERGWILD: