diff options
-rw-r--r-- | drivers/ide/ide-taskfile.c | 10 |
1 files changed, 3 insertions, 7 deletions
diff --git a/drivers/ide/ide-taskfile.c b/drivers/ide/ide-taskfile.c index 67fb73559fd5..34b9872f35d1 100644 --- a/drivers/ide/ide-taskfile.c +++ b/drivers/ide/ide-taskfile.c | |||
@@ -480,13 +480,9 @@ int ide_taskfile_ioctl(ide_drive_t *drive, unsigned long arg) | |||
480 | u16 nsect = 0; | 480 | u16 nsect = 0; |
481 | char __user *buf = (char __user *)arg; | 481 | char __user *buf = (char __user *)arg; |
482 | 482 | ||
483 | req_task = kzalloc(tasksize, GFP_KERNEL); | 483 | req_task = memdup_user(buf, tasksize); |
484 | if (req_task == NULL) | 484 | if (IS_ERR(req_task)) |
485 | return -ENOMEM; | 485 | return PTR_ERR(req_task); |
486 | if (copy_from_user(req_task, buf, tasksize)) { | ||
487 | kfree(req_task); | ||
488 | return -EFAULT; | ||
489 | } | ||
490 | 486 | ||
491 | taskout = req_task->out_size; | 487 | taskout = req_task->out_size; |
492 | taskin = req_task->in_size; | 488 | taskin = req_task->in_size; |