vserver 1.9.3

[linux-2.6.git] / drivers / isdn / act2000 / act2000_isa.c

diff --git a/drivers/isdn/act2000/act2000_isa.c b/drivers/isdn/act2000/act2000_isa.c
index 662a61e..b363d09 100644 (file)
--- a/drivers/isdn/act2000/act2000_isa.c
+++ b/drivers/isdn/act2000/act2000_isa.c
@@ -405,7 +405,7 @@ act2000_isa_getid(act2000_card * card)
  * Download microcode into card, check Firmware signature.
  */
 int
-act2000_isa_download(act2000_card * card, act2000_ddef * cb)
+act2000_isa_download(act2000_card * card, act2000_ddef __user * cb)
 {
         unsigned int length;
         int ret;
@@ -413,18 +413,18 @@ act2000_isa_download(act2000_card * card, act2000_ddef * cb)
         int c;
         long timeout;
         u_char *b;
-        u_char *p;
+        u_char __user *p;
         u_char *buf;
         act2000_ddef cblock;
 
         if (!act2000_isa_reset(card->port))
                 return -ENXIO;
         act2000_isa_delay(HZ / 2);
-        if(copy_from_user(&cblock, (char *) cb, sizeof(cblock)))
+        if(copy_from_user(&cblock, cb, sizeof(cblock)))
                return -EFAULT;
         length = cblock.length;
         p = cblock.buffer;
-        if ((ret = verify_area(VERIFY_READ, (void *) p, length)))
+        if ((ret = verify_area(VERIFY_READ, p, length)))
                 return ret;
         buf = (u_char *) kmalloc(1024, GFP_KERNEL);
         if (!buf)
@@ -434,7 +434,10 @@ act2000_isa_download(act2000_card * card, act2000_ddef * cb)
                 l = (length > 1024) ? 1024 : length;
                 c = 0;
                 b = buf;
-                copy_from_user(buf, p, l);
+                if (copy_from_user(buf, p, l)) {
+                        kfree(buf);
+                        return -EFAULT;
+                }
                 while (c < l) {
                         if (act2000_isa_writeb(card, *b++)) {
                                 printk(KERN_WARNING