diff options
Diffstat (limited to 'drivers/mtd/mtdchar.c')
| -rw-r--r-- | drivers/mtd/mtdchar.c | 13 |
1 files changed, 8 insertions, 5 deletions
diff --git a/drivers/mtd/mtdchar.c b/drivers/mtd/mtdchar.c index d0f9c4b0285c..05860288a7af 100644 --- a/drivers/mtd/mtdchar.c +++ b/drivers/mtd/mtdchar.c @@ -615,21 +615,24 @@ static int mtdchar_write_ioctl(struct mtd_info *mtd, if (!usr_oob) req.ooblen = 0; + req.len &= 0xffffffff; + req.ooblen &= 0xffffffff; + if (req.start + req.len > mtd->size) return -EINVAL; datbuf_len = min_t(size_t, req.len, mtd->erasesize); if (datbuf_len > 0) { - datbuf = kmalloc(datbuf_len, GFP_KERNEL); + datbuf = kvmalloc(datbuf_len, GFP_KERNEL); if (!datbuf) return -ENOMEM; } oobbuf_len = min_t(size_t, req.ooblen, mtd->erasesize); if (oobbuf_len > 0) { - oobbuf = kmalloc(oobbuf_len, GFP_KERNEL); + oobbuf = kvmalloc(oobbuf_len, GFP_KERNEL); if (!oobbuf) { - kfree(datbuf); + kvfree(datbuf); return -ENOMEM; } } @@ -679,8 +682,8 @@ static int mtdchar_write_ioctl(struct mtd_info *mtd, usr_oob += ops.oobretlen; } - kfree(datbuf); - kfree(oobbuf); + kvfree(datbuf); + kvfree(oobbuf); return ret; } |