This commit was manufactured by cvs2svn to create tag

[linux-2.6.git] / drivers / char / n_r3964.c

diff --git a/drivers/char/n_r3964.c b/drivers/char/n_r3964.c
index 3883073..e24b7ef 100644 (file)
--- a/drivers/char/n_r3964.c
+++ b/drivers/char/n_r3964.c
@@ -139,7 +139,7 @@ static void r3964_close(struct tty_struct *tty);
 static ssize_t r3964_read(struct tty_struct *tty, struct file *file,
                      unsigned char __user *buf, size_t nr);
 static ssize_t r3964_write(struct tty_struct * tty, struct file * file,
-                      const unsigned char * buf, size_t nr);
+                      const unsigned char __user * buf, size_t nr);
 static int r3964_ioctl(struct tty_struct * tty, struct file * file,
                        unsigned int cmd, unsigned long arg);
 static void r3964_set_termios(struct tty_struct *tty, struct termios * old);
@@ -1246,12 +1246,13 @@ repeat:
 }
 
 static ssize_t r3964_write(struct tty_struct * tty, struct file * file,
-                          const unsigned char *data, size_t count)
+                          const unsigned char __user *data, size_t count)
 {
    struct r3964_info *pInfo=(struct r3964_info*)tty->disc_data;
    struct r3964_block_header *pHeader;
    struct r3964_client_info *pClient;
    unsigned char *new_data;
+   int status;
    int pid;
    
    TRACE_L("write request, %d characters", count);
@@ -1262,6 +1263,12 @@ static ssize_t r3964_write(struct tty_struct * tty, struct file * file,
    if(!pInfo)
       return -EIO;
 
+   status = verify_area (VERIFY_READ, data, count);
+   if (status != 0) 
+   {
+      return status;
+   }
+
 /*
  * Ensure that the caller does not wish to send too much.
  */
@@ -1276,7 +1283,7 @@ static ssize_t r3964_write(struct tty_struct * tty, struct file * file,
       count = R3964_MTU;
    }
 /*
- * Allocate a buffer for the data and copy it from the buffer with header prepended
+ * Allocate a buffer for the data and fetch it from the user space.
  */
    new_data = kmalloc (count+sizeof(struct r3964_block_header), GFP_KERNEL);
    TRACE_M("r3964_write - kmalloc %x",(int)new_data);
@@ -1303,7 +1310,7 @@ static ssize_t r3964_write(struct tty_struct * tty, struct file * file,
       pHeader->owner = pClient;
    }
 
-   memcpy(pHeader->data, data, count); /* We already verified this */
+   __copy_from_user(pHeader->data, data, count); /* We already verified this */
 
    if(pInfo->flags & R3964_DEBUG)
    {