Merge to Fedora Core 2 kernel-2.6.8-1.521

[linux-2.6.git] / drivers / char / ipmi / ipmi_devintf.c

diff --git a/drivers/char/ipmi/ipmi_devintf.c b/drivers/char/ipmi/ipmi_devintf.c
index 0a2eeba..8d1a08b 100644 (file)
--- a/drivers/char/ipmi/ipmi_devintf.c
+++ b/drivers/char/ipmi/ipmi_devintf.c
@@ -174,7 +174,7 @@ static int handle_send_req(ipmi_user_t     user,
 {
        int              rv;
        struct ipmi_addr addr;
-       unsigned char    *msgdata;
+       struct kernel_ipmi_msg msg;
 
        if (req->addr_len > sizeof(struct ipmi_addr))
                return -EINVAL;
@@ -182,8 +182,11 @@ static int handle_send_req(ipmi_user_t     user,
        if (copy_from_user(&addr, req->addr, req->addr_len))
                return -EFAULT;
 
-       msgdata = kmalloc(IPMI_MAX_MSG_LENGTH, GFP_KERNEL);
-       if (!msgdata)
+       msg.netfn = req->msg.netfn;
+       msg.cmd = req->msg.cmd;
+       msg.data_len = req->msg.data_len;
+       msg.data = kmalloc(IPMI_MAX_MSG_LENGTH, GFP_KERNEL);
+       if (!msg.data)
                return -ENOMEM;
 
        /* From here out we cannot return, we must jump to "out" for
@@ -199,7 +202,7 @@ static int handle_send_req(ipmi_user_t     user,
                        goto out;
                }
 
-               if (copy_from_user(msgdata,
+               if (copy_from_user(msg.data,
                                   req->msg.data,
                                   req->msg.data_len))
                {
@@ -207,20 +210,19 @@ static int handle_send_req(ipmi_user_t     user,
                        goto out;
                }
        } else {
-               req->msg.data_len = 0;
+               msg.data_len = 0;
        }
-       req->msg.data = msgdata;
 
        rv = ipmi_request_settime(user,
                                  &addr,
                                  req->msgid,
-                                 &(req->msg),
+                                 &msg,
                                  NULL,
                                  0,
                                  retries,
                                  retry_time_ms);
  out:
-       kfree(msgdata);
+       kfree(msg.data);
        return rv;
 }