aboutsummaryrefslogtreecommitdiffstats
path: root/drivers/mtd/mtdchar.c
diff options
context:
space:
mode:
Diffstat (limited to 'drivers/mtd/mtdchar.c')
-rw-r--r--drivers/mtd/mtdchar.c4
1 files changed, 2 insertions, 2 deletions
diff --git a/drivers/mtd/mtdchar.c b/drivers/mtd/mtdchar.c
index 4b3156f9b36f..5fc2c4216c03 100644
--- a/drivers/mtd/mtdchar.c
+++ b/drivers/mtd/mtdchar.c
@@ -479,6 +479,7 @@ static int mtd_ioctl(struct inode *inode, struct file *file,
479 { 479 {
480 struct mtd_oob_buf buf; 480 struct mtd_oob_buf buf;
481 struct mtd_oob_ops ops; 481 struct mtd_oob_ops ops;
482 struct mtd_oob_buf __user *user_buf = argp;
482 uint32_t retlen; 483 uint32_t retlen;
483 484
484 if(!(file->f_mode & 2)) 485 if(!(file->f_mode & 2))
@@ -522,8 +523,7 @@ static int mtd_ioctl(struct inode *inode, struct file *file,
522 if (ops.oobretlen > 0xFFFFFFFFU) 523 if (ops.oobretlen > 0xFFFFFFFFU)
523 ret = -EOVERFLOW; 524 ret = -EOVERFLOW;
524 retlen = ops.oobretlen; 525 retlen = ops.oobretlen;
525 if (copy_to_user(&((struct mtd_oob_buf *)argp)->length, 526 if (copy_to_user(&user_buf->length, &retlen, sizeof(buf.length)))
526 &retlen, sizeof(buf.length)))
527 ret = -EFAULT; 527 ret = -EFAULT;
528 528
529 kfree(ops.oobbuf); 529 kfree(ops.oobbuf);