diff options
Diffstat (limited to 'drivers/net/wan/farsync.c')
-rw-r--r-- | drivers/net/wan/farsync.c | 14 |
1 files changed, 4 insertions, 10 deletions
diff --git a/drivers/net/wan/farsync.c b/drivers/net/wan/farsync.c index e087b9a6daaa..43b77271532b 100644 --- a/drivers/net/wan/farsync.c +++ b/drivers/net/wan/farsync.c | |||
@@ -2038,16 +2038,10 @@ fst_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd) | |||
2038 | 2038 | ||
2039 | /* Now copy the data to the card. */ | 2039 | /* Now copy the data to the card. */ |
2040 | 2040 | ||
2041 | buf = kmalloc(wrthdr.size, GFP_KERNEL); | 2041 | buf = memdup_user(ifr->ifr_data + sizeof(struct fstioc_write), |
2042 | if (!buf) | 2042 | wrthdr.size); |
2043 | return -ENOMEM; | 2043 | if (IS_ERR(buf)) |
2044 | 2044 | return PTR_ERR(buf); | |
2045 | if (copy_from_user(buf, | ||
2046 | ifr->ifr_data + sizeof (struct fstioc_write), | ||
2047 | wrthdr.size)) { | ||
2048 | kfree(buf); | ||
2049 | return -EFAULT; | ||
2050 | } | ||
2051 | 2045 | ||
2052 | memcpy_toio(card->mem + wrthdr.offset, buf, wrthdr.size); | 2046 | memcpy_toio(card->mem + wrthdr.offset, buf, wrthdr.size); |
2053 | kfree(buf); | 2047 | kfree(buf); |