linux 2.6.16.38 w/ vs2.0.3-rc1

[linux-2.6.git] / drivers / s390 / char / keyboard.c

diff --git a/drivers/s390/char/keyboard.c b/drivers/s390/char/keyboard.c
index 5e35728..a317a12 100644 (file)
--- a/drivers/s390/char/keyboard.c
+++ b/drivers/s390/char/keyboard.c
@@ -32,11 +32,11 @@ static k_handler_fn K_HANDLERS;
 static k_handler_fn *k_handler[16] = { K_HANDLERS };
 
 /* maximum values each key_handler can handle */
-static const int max_vals[] = {
+static const int kbd_max_vals[] = {
        255, ARRAY_SIZE(func_table) - 1, NR_FN_HANDLER - 1, 0,
        NR_DEAD - 1, 0, 0, 0, 0, 0, 0, 0, 0, 0
 };
-static const int NR_TYPES = ARRAY_SIZE(max_vals);
+static const int KBD_NR_TYPES = ARRAY_SIZE(kbd_max_vals);
 
 static unsigned char ret_diacr[NR_DEAD] = {
        '`', '\'', '^', '~', '"', ','
@@ -99,13 +99,11 @@ out_fn_handler:
        kfree(kbd->fn_handler);
 out_func:
        for (i = 0; i < ARRAY_SIZE(func_table); i++)
-               if (kbd->func_table[i])
-                       kfree(kbd->func_table[i]);
+               kfree(kbd->func_table[i]);
        kfree(kbd->func_table);
 out_maps:
        for (i = 0; i < ARRAY_SIZE(key_maps); i++)
-               if (kbd->key_maps[i])
-                       kfree(kbd->key_maps[i]);
+               kfree(kbd->key_maps[i]);
        kfree(kbd->key_maps);
 out_kbd:
        kfree(kbd);
@@ -121,12 +119,10 @@ kbd_free(struct kbd_data *kbd)
        kfree(kbd->accent_table);
        kfree(kbd->fn_handler);
        for (i = 0; i < ARRAY_SIZE(func_table); i++)
-               if (kbd->func_table[i])
-                       kfree(kbd->func_table[i]);
+               kfree(kbd->func_table[i]);
        kfree(kbd->func_table);
        for (i = 0; i < ARRAY_SIZE(key_maps); i++)
-               if (kbd->key_maps[i])
-                       kfree(kbd->key_maps[i]);
+               kfree(kbd->key_maps[i]);
        kfree(kbd->key_maps);
        kfree(kbd);
 }
@@ -360,7 +356,7 @@ do_kdsk_ioctl(struct kbd_data *kbd, struct kbentry __user *user_kbe,
                key_map = kbd->key_maps[tmp.kb_table];
                if (key_map) {
                    val = U(key_map[tmp.kb_index]);
-                   if (KTYP(val) >= NR_TYPES)
+                   if (KTYP(val) >= KBD_NR_TYPES)
                        val = K_HOLE;
                } else
                    val = (tmp.kb_index ? K_HOLE : K_NOSUCHMAP);
@@ -378,9 +374,9 @@ do_kdsk_ioctl(struct kbd_data *kbd, struct kbentry __user *user_kbe,
                        break;
                }
 
-               if (KTYP(tmp.kb_value) >= NR_TYPES)
+               if (KTYP(tmp.kb_value) >= KBD_NR_TYPES)
                        return -EINVAL;
-               if (KVAL(tmp.kb_value) > max_vals[KTYP(tmp.kb_value)])
+               if (KVAL(tmp.kb_value) > kbd_max_vals[KTYP(tmp.kb_value)])
                        return -EINVAL;
 
                if (!(key_map = kbd->key_maps[tmp.kb_table])) {
@@ -444,7 +440,11 @@ do_kdgkb_ioctl(struct kbd_data *kbd, struct kbsentry __user *u_kbs,
                        return -EPERM;
                len = strnlen_user(u_kbs->kb_string,
                                   sizeof(u_kbs->kb_string) - 1);
-               p = kmalloc(len, GFP_KERNEL);
+               if (!len)
+                       return -EFAULT;
+               if (len > sizeof(u_kbs->kb_string) - 1)
+                       return -EINVAL;
+               p = kmalloc(len + 1, GFP_KERNEL);
                if (!p)
                        return -ENOMEM;
                if (copy_from_user(p, u_kbs->kb_string, len)) {
@@ -452,8 +452,7 @@ do_kdgkb_ioctl(struct kbd_data *kbd, struct kbsentry __user *u_kbs,
                        return -EFAULT;
                }
                p[len] = 0;
-               if (kbd->func_table[kb_func])
-                       kfree(kbd->func_table[kb_func]);
+               kfree(kbd->func_table[kb_func]);
                kbd->func_table[kb_func] = p;
                break;
        }