Fedora kernel-2.6.17-1.2142_FC4 patched with stable patch-2.6.17.4-vs2.0.2-rc26.diff

[linux-2.6.git] / sound / isa / wavefront / wavefront_fx.c

diff --git a/sound/isa/wavefront/wavefront_fx.c b/sound/isa/wavefront/wavefront_fx.c
index 92aa782..180661c 100644 (file)
--- a/sound/isa/wavefront/wavefront_fx.c
+++ b/sound/isa/wavefront/wavefront_fx.c
@@ -460,7 +460,7 @@ snd_wavefront_fx_detect (snd_wavefront_t *dev)
 }
 
 int
-snd_wavefront_fx_open (snd_hwdep_t *hw, struct file *file)
+snd_wavefront_fx_open (struct snd_hwdep *hw, struct file *file)
 
 {
        if (!try_module_get(hw->card->module))
@@ -470,7 +470,7 @@ snd_wavefront_fx_open (snd_hwdep_t *hw, struct file *file)
 }
 
 int 
-snd_wavefront_fx_release (snd_hwdep_t *hw, struct file *file)
+snd_wavefront_fx_release (struct snd_hwdep *hw, struct file *file)
 
 {
        module_put(hw->card->module);
@@ -478,16 +478,17 @@ snd_wavefront_fx_release (snd_hwdep_t *hw, struct file *file)
 }
 
 int
-snd_wavefront_fx_ioctl (snd_hwdep_t *sdev, struct file *file,
+snd_wavefront_fx_ioctl (struct snd_hwdep *sdev, struct file *file,
                        unsigned int cmd, unsigned long arg)
 
 {
-       snd_card_t *card;
+       struct snd_card *card;
        snd_wavefront_card_t *acard;
        snd_wavefront_t *dev;
        wavefront_fx_info r;
-       unsigned short page_data[256];
+       unsigned short *page_data = NULL;
        unsigned short *pd;
+       int err = 0;
 
        snd_assert(sdev->card != NULL, return -ENODEV);
        
@@ -514,23 +515,29 @@ snd_wavefront_fx_ioctl (snd_hwdep_t *sdev, struct file *file,
                } else if (r.data[2] == 1) {
                        pd = (unsigned short *) &r.data[3];
                } else {
-                       if (r.data[2] > (long)sizeof (page_data)) {
+                       if (r.data[2] > 256) {
                                snd_printk ("cannot write "
-                                           "> 255 bytes to FX\n");
+                                           "> 512 bytes to FX\n");
                                return -EIO;
                        }
+                       page_data = kmalloc(r.data[2] * sizeof(short), GFP_KERNEL);
+                       if (!page_data)
+                               return -ENOMEM;
                        if (copy_from_user (page_data,
                                            (unsigned char __user *) r.data[3],
-                                           r.data[2]))
+                                           r.data[2] * sizeof(short))) {
+                               kfree(page_data);
                                return -EFAULT;
+                       }
                        pd = page_data;
                }
 
-               wavefront_fx_memset (dev,
+               err = wavefront_fx_memset (dev,
                             r.data[0], /* page */
                             r.data[1], /* addr */
                             r.data[2], /* cnt */
                             pd);
+               kfree(page_data);
                break;
 
        default:
@@ -538,7 +545,7 @@ snd_wavefront_fx_ioctl (snd_hwdep_t *sdev, struct file *file,
                            r.request);
                return -ENOTTY;
        }
-       return 0;
+       return err;
 }
 
 /* YSS225 initialization.