aboutsummaryrefslogtreecommitdiffstats
path: root/drivers
diff options
context:
space:
mode:
Diffstat (limited to 'drivers')
-rw-r--r--drivers/s390/scsi/zfcp_aux.c4
-rw-r--r--drivers/s390/scsi/zfcp_cfdc.c12
2 files changed, 4 insertions, 12 deletions
diff --git a/drivers/s390/scsi/zfcp_aux.c b/drivers/s390/scsi/zfcp_aux.c
index 6e9c7f33e276..7c01c4c3f6b9 100644
--- a/drivers/s390/scsi/zfcp_aux.c
+++ b/drivers/s390/scsi/zfcp_aux.c
@@ -98,13 +98,11 @@ static void __init zfcp_init_device_setup(char *devstr)
98 u64 wwpn, lun; 98 u64 wwpn, lun;
99 99
100 /* duplicate devstr and keep the original for sysfs presentation*/ 100 /* duplicate devstr and keep the original for sysfs presentation*/
101 str_saved = kmalloc(strlen(devstr) + 1, GFP_KERNEL); 101 str_saved = kstrdup(devstr, GFP_KERNEL);
102 str = str_saved; 102 str = str_saved;
103 if (!str) 103 if (!str)
104 return; 104 return;
105 105
106 strcpy(str, devstr);
107
108 token = strsep(&str, ","); 106 token = strsep(&str, ",");
109 if (!token || strlen(token) >= ZFCP_BUS_ID_SIZE) 107 if (!token || strlen(token) >= ZFCP_BUS_ID_SIZE)
110 goto err_out; 108 goto err_out;
diff --git a/drivers/s390/scsi/zfcp_cfdc.c b/drivers/s390/scsi/zfcp_cfdc.c
index 1a2db0a35737..fcbd2b756da4 100644
--- a/drivers/s390/scsi/zfcp_cfdc.c
+++ b/drivers/s390/scsi/zfcp_cfdc.c
@@ -189,18 +189,12 @@ static long zfcp_cfdc_dev_ioctl(struct file *file, unsigned int command,
189 if (!fsf_cfdc) 189 if (!fsf_cfdc)
190 return -ENOMEM; 190 return -ENOMEM;
191 191
192 data = kmalloc(sizeof(struct zfcp_cfdc_data), GFP_KERNEL); 192 data = memdup_user(data_user, sizeof(*data_user));
193 if (!data) { 193 if (IS_ERR(data)) {
194 retval = -ENOMEM; 194 retval = PTR_ERR(data);
195 goto no_mem_sense; 195 goto no_mem_sense;
196 } 196 }
197 197
198 retval = copy_from_user(data, data_user, sizeof(*data));
199 if (retval) {
200 retval = -EFAULT;
201 goto free_buffer;
202 }
203
204 if (data->signature != 0xCFDCACDF) { 198 if (data->signature != 0xCFDCACDF) {
205 retval = -EINVAL; 199 retval = -EINVAL;
206 goto free_buffer; 200 goto free_buffer;