diff options
-rw-r--r-- | drivers/media/IR/ir-lirc-codec.c | 11 |
1 files changed, 3 insertions, 8 deletions
diff --git a/drivers/media/IR/ir-lirc-codec.c b/drivers/media/IR/ir-lirc-codec.c index afb1ada36c78..ee1f2d443ab2 100644 --- a/drivers/media/IR/ir-lirc-codec.c +++ b/drivers/media/IR/ir-lirc-codec.c | |||
@@ -74,14 +74,9 @@ static ssize_t ir_lirc_transmit_ir(struct file *file, const char *buf, | |||
74 | if (count > LIRCBUF_SIZE || count % 2 == 0) | 74 | if (count > LIRCBUF_SIZE || count % 2 == 0) |
75 | return -EINVAL; | 75 | return -EINVAL; |
76 | 76 | ||
77 | txbuf = kzalloc(sizeof(int) * LIRCBUF_SIZE, GFP_KERNEL); | 77 | txbuf = memdup_user(buf, n); |
78 | if (!txbuf) | 78 | if (IS_ERR(txbuf)) |
79 | return -ENOMEM; | 79 | return PTR_ERR(txbuf); |
80 | |||
81 | if (copy_from_user(txbuf, buf, n)) { | ||
82 | ret = -EFAULT; | ||
83 | goto out; | ||
84 | } | ||
85 | 80 | ||
86 | ir_dev = lirc->ir_dev; | 81 | ir_dev = lirc->ir_dev; |
87 | if (!ir_dev) { | 82 | if (!ir_dev) { |