diff options
| -rw-r--r-- | fs/ncpfs/ioctl.c | 21 |
1 files changed, 7 insertions, 14 deletions
diff --git a/fs/ncpfs/ioctl.c b/fs/ncpfs/ioctl.c index f54360f50a9c..fa038df63ac8 100644 --- a/fs/ncpfs/ioctl.c +++ b/fs/ncpfs/ioctl.c | |||
| @@ -660,13 +660,10 @@ outrel: | |||
| 660 | if (user.object_name_len > NCP_OBJECT_NAME_MAX_LEN) | 660 | if (user.object_name_len > NCP_OBJECT_NAME_MAX_LEN) |
| 661 | return -ENOMEM; | 661 | return -ENOMEM; |
| 662 | if (user.object_name_len) { | 662 | if (user.object_name_len) { |
| 663 | newname = kmalloc(user.object_name_len, GFP_USER); | 663 | newname = memdup_user(user.object_name, |
| 664 | if (!newname) | 664 | user.object_name_len); |
| 665 | return -ENOMEM; | 665 | if (IS_ERR(newname)) |
| 666 | if (copy_from_user(newname, user.object_name, user.object_name_len)) { | 666 | return PTR_ERR(newname); |
| 667 | kfree(newname); | ||
| 668 | return -EFAULT; | ||
| 669 | } | ||
| 670 | } else { | 667 | } else { |
| 671 | newname = NULL; | 668 | newname = NULL; |
| 672 | } | 669 | } |
| @@ -760,13 +757,9 @@ outrel: | |||
| 760 | if (user.len > NCP_PRIVATE_DATA_MAX_LEN) | 757 | if (user.len > NCP_PRIVATE_DATA_MAX_LEN) |
| 761 | return -ENOMEM; | 758 | return -ENOMEM; |
| 762 | if (user.len) { | 759 | if (user.len) { |
| 763 | new = kmalloc(user.len, GFP_USER); | 760 | new = memdup_user(user.data, user.len); |
| 764 | if (!new) | 761 | if (IS_ERR(new)) |
| 765 | return -ENOMEM; | 762 | return PTR_ERR(new); |
| 766 | if (copy_from_user(new, user.data, user.len)) { | ||
| 767 | kfree(new); | ||
| 768 | return -EFAULT; | ||
| 769 | } | ||
| 770 | } else { | 763 | } else { |
| 771 | new = NULL; | 764 | new = NULL; |
| 772 | } | 765 | } |