1 files changed, 7 insertions, 4 deletions

diff --git a/drivers/block/floppy.c b/drivers/block/floppy.c
index 8f5565bf34cd..fa9bb742df6e 100644
--- a/drivers/block/floppy.c
+++ b/drivers/block/floppy.c
@@ -3067,7 +3067,10 @@ static int raw_cmd_copyout(int cmd, void __user *param,
         int ret;
 
         while (ptr) {
-                ret = copy_to_user(param, ptr, sizeof(*ptr));
+                struct floppy_raw_cmd cmd = *ptr;
+                cmd.next = NULL;
+                cmd.kernel_data = NULL;
+                ret = copy_to_user(param, &cmd, sizeof(cmd));
                 if (ret)
                         return -EFAULT;
                 param += sizeof(struct floppy_raw_cmd);
@@ -3121,10 +3124,11 @@ loop:
                 return -ENOMEM;
         *rcmd = ptr;
         ret = copy_from_user(ptr, param, sizeof(*ptr));
-        if (ret)
-                return -EFAULT;
         ptr->next = NULL;
         ptr->buffer_length = 0;
+        ptr->kernel_data = NULL;
+        if (ret)
+                return -EFAULT;
         param += sizeof(struct floppy_raw_cmd);
         if (ptr->cmd_count > 33)
                         /* the command may now also take up the space
@@ -3140,7 +3144,6 @@ loop:
         for (i = 0; i < 16; i++)
                 ptr->reply[i] = 0;
         ptr->resultcode = 0;
-        ptr->kernel_data = NULL;
 
         if (ptr->flags & (FD_RAW_READ | FD_RAW_WRITE)) {
                 if (ptr->length <= 0)