diff options
-rw-r--r-- | drivers/mtd/mtdchar.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/drivers/mtd/mtdchar.c b/drivers/mtd/mtdchar.c index 4b3156f9b36f..5fc2c4216c03 100644 --- a/drivers/mtd/mtdchar.c +++ b/drivers/mtd/mtdchar.c | |||
@@ -479,6 +479,7 @@ static int mtd_ioctl(struct inode *inode, struct file *file, | |||
479 | { | 479 | { |
480 | struct mtd_oob_buf buf; | 480 | struct mtd_oob_buf buf; |
481 | struct mtd_oob_ops ops; | 481 | struct mtd_oob_ops ops; |
482 | struct mtd_oob_buf __user *user_buf = argp; | ||
482 | uint32_t retlen; | 483 | uint32_t retlen; |
483 | 484 | ||
484 | if(!(file->f_mode & 2)) | 485 | if(!(file->f_mode & 2)) |
@@ -522,8 +523,7 @@ static int mtd_ioctl(struct inode *inode, struct file *file, | |||
522 | if (ops.oobretlen > 0xFFFFFFFFU) | 523 | if (ops.oobretlen > 0xFFFFFFFFU) |
523 | ret = -EOVERFLOW; | 524 | ret = -EOVERFLOW; |
524 | retlen = ops.oobretlen; | 525 | retlen = ops.oobretlen; |
525 | if (copy_to_user(&((struct mtd_oob_buf *)argp)->length, | 526 | if (copy_to_user(&user_buf->length, &retlen, sizeof(buf.length))) |
526 | &retlen, sizeof(buf.length))) | ||
527 | ret = -EFAULT; | 527 | ret = -EFAULT; |
528 | 528 | ||
529 | kfree(ops.oobbuf); | 529 | kfree(ops.oobbuf); |