diff options
| author | Ingo Molnar <mingo@kernel.org> | 2014-05-22 10:28:56 +0200 |
|---|---|---|
| committer | Ingo Molnar <mingo@kernel.org> | 2014-05-22 10:28:56 +0200 |
| commit | 65c2ce70046c779974af8b5dfc25a0df489089b5 (patch) | |
| tree | b16f152eb62b71cf5a1edc51da865b357c989922 /drivers/block | |
| parent | 842514849a616e9b61acad65771c7afe01e651f9 (diff) | |
| parent | 4b660a7f5c8099d88d1a43d8ae138965112592c7 (diff) | |
| download | linux-65c2ce70046c779974af8b5dfc25a0df489089b5.tar.bz2 | |
Merge tag 'v3.15-rc6' into sched/core, to pick up the latest fixes
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Diffstat (limited to 'drivers/block')
| -rw-r--r-- | drivers/block/floppy.c | 11 |
1 files changed, 7 insertions, 4 deletions
diff --git a/drivers/block/floppy.c b/drivers/block/floppy.c index 8f5565bf34cd..fa9bb742df6e 100644 --- a/drivers/block/floppy.c +++ b/drivers/block/floppy.c @@ -3067,7 +3067,10 @@ static int raw_cmd_copyout(int cmd, void __user *param, int ret; while (ptr) { - ret = copy_to_user(param, ptr, sizeof(*ptr)); + struct floppy_raw_cmd cmd = *ptr; + cmd.next = NULL; + cmd.kernel_data = NULL; + ret = copy_to_user(param, &cmd, sizeof(cmd)); if (ret) return -EFAULT; param += sizeof(struct floppy_raw_cmd); @@ -3121,10 +3124,11 @@ loop: return -ENOMEM; *rcmd = ptr; ret = copy_from_user(ptr, param, sizeof(*ptr)); - if (ret) - return -EFAULT; ptr->next = NULL; ptr->buffer_length = 0; + ptr->kernel_data = NULL; + if (ret) + return -EFAULT; param += sizeof(struct floppy_raw_cmd); if (ptr->cmd_count > 33) /* the command may now also take up the space @@ -3140,7 +3144,6 @@ loop: for (i = 0; i < 16; i++) ptr->reply[i] = 0; ptr->resultcode = 0; - ptr->kernel_data = NULL; if (ptr->flags & (FD_RAW_READ | FD_RAW_WRITE)) { if (ptr->length <= 0) |