aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
-rw-r--r--drivers/ieee1394/raw1394.c10
1 files changed, 7 insertions, 3 deletions
diff --git a/drivers/ieee1394/raw1394.c b/drivers/ieee1394/raw1394.c
index 281229b027f5..9b71390b0a0b 100644
--- a/drivers/ieee1394/raw1394.c
+++ b/drivers/ieee1394/raw1394.c
@@ -369,6 +369,7 @@ static const char __user *raw1394_compat_write(const char __user *buf)
369{ 369{
370 struct compat_raw1394_req __user *cr = (typeof(cr)) buf; 370 struct compat_raw1394_req __user *cr = (typeof(cr)) buf;
371 struct raw1394_request __user *r; 371 struct raw1394_request __user *r;
372
372 r = compat_alloc_user_space(sizeof(struct raw1394_request)); 373 r = compat_alloc_user_space(sizeof(struct raw1394_request));
373 374
374#define C(x) __copy_in_user(&r->x, &cr->x, sizeof(r->x)) 375#define C(x) __copy_in_user(&r->x, &cr->x, sizeof(r->x))
@@ -378,7 +379,8 @@ static const char __user *raw1394_compat_write(const char __user *buf)
378 C(tag) || 379 C(tag) ||
379 C(sendb) || 380 C(sendb) ||
380 C(recvb)) 381 C(recvb))
381 return ERR_PTR(-EFAULT); 382 return (__force const char __user *)ERR_PTR(-EFAULT);
383
382 return (const char __user *)r; 384 return (const char __user *)r;
383} 385}
384#undef C 386#undef C
@@ -389,6 +391,7 @@ static int
389raw1394_compat_read(const char __user *buf, struct raw1394_request *r) 391raw1394_compat_read(const char __user *buf, struct raw1394_request *r)
390{ 392{
391 struct compat_raw1394_req __user *cr = (typeof(cr)) buf; 393 struct compat_raw1394_req __user *cr = (typeof(cr)) buf;
394
392 if (!access_ok(VERIFY_WRITE, cr, sizeof(struct compat_raw1394_req)) || 395 if (!access_ok(VERIFY_WRITE, cr, sizeof(struct compat_raw1394_req)) ||
393 P(type) || 396 P(type) ||
394 P(error) || 397 P(error) ||
@@ -400,6 +403,7 @@ raw1394_compat_read(const char __user *buf, struct raw1394_request *r)
400 P(sendb) || 403 P(sendb) ||
401 P(recvb)) 404 P(recvb))
402 return -EFAULT; 405 return -EFAULT;
406
403 return sizeof(struct compat_raw1394_req); 407 return sizeof(struct compat_raw1394_req);
404} 408}
405#undef P 409#undef P
@@ -2249,8 +2253,8 @@ static ssize_t raw1394_write(struct file *file, const char __user * buffer,
2249 sizeof(struct compat_raw1394_req) != 2253 sizeof(struct compat_raw1394_req) !=
2250 sizeof(struct raw1394_request)) { 2254 sizeof(struct raw1394_request)) {
2251 buffer = raw1394_compat_write(buffer); 2255 buffer = raw1394_compat_write(buffer);
2252 if (IS_ERR(buffer)) 2256 if (IS_ERR((__force void *)buffer))
2253 return PTR_ERR(buffer); 2257 return PTR_ERR((__force void *)buffer);
2254 } else 2258 } else
2255#endif 2259#endif
2256 if (count != sizeof(struct raw1394_request)) { 2260 if (count != sizeof(struct raw1394_request)) {