X-Git-Url: http://git.onelab.eu/?a=blobdiff_plain;f=drivers%2Fchar%2Fn_r3964.c;h=3883073ab48f556e4d080b6721a2b194bdce9250;hb=6a77f38946aaee1cd85eeec6cf4229b204c15071;hp=e24b7efafadc285dad9e149f395ffd96da82326f;hpb=87fc8d1bb10cd459024a742c6a10961fefcef18f;p=linux-2.6.git

diff --git a/drivers/char/n_r3964.c b/drivers/char/n_r3964.c
index e24b7efaf..3883073ab 100644
--- a/drivers/char/n_r3964.c
+++ b/drivers/char/n_r3964.c
@@ -139,7 +139,7 @@ static void r3964_close(struct tty_struct *tty);
 static ssize_t r3964_read(struct tty_struct *tty, struct file *file,
                      unsigned char __user *buf, size_t nr);
 static ssize_t r3964_write(struct tty_struct * tty, struct file * file,
-                      const unsigned char __user * buf, size_t nr);
+                      const unsigned char * buf, size_t nr);
 static int r3964_ioctl(struct tty_struct * tty, struct file * file,
                        unsigned int cmd, unsigned long arg);
 static void r3964_set_termios(struct tty_struct *tty, struct termios * old);
@@ -1246,13 +1246,12 @@ repeat:
 }
 
 static ssize_t r3964_write(struct tty_struct * tty, struct file * file,
-			   const unsigned char __user *data, size_t count)
+			   const unsigned char *data, size_t count)
 {
    struct r3964_info *pInfo=(struct r3964_info*)tty->disc_data;
    struct r3964_block_header *pHeader;
    struct r3964_client_info *pClient;
    unsigned char *new_data;
-   int status;
    int pid;
    
    TRACE_L("write request, %d characters", count);
@@ -1263,12 +1262,6 @@ static ssize_t r3964_write(struct tty_struct * tty, struct file * file,
    if(!pInfo)
       return -EIO;
 
-   status = verify_area (VERIFY_READ, data, count);
-   if (status != 0) 
-   {
-      return status;
-   }
-
 /*
  * Ensure that the caller does not wish to send too much.
  */
@@ -1283,7 +1276,7 @@ static ssize_t r3964_write(struct tty_struct * tty, struct file * file,
       count = R3964_MTU;
    }
 /*
- * Allocate a buffer for the data and fetch it from the user space.
+ * Allocate a buffer for the data and copy it from the buffer with header prepended
  */
    new_data = kmalloc (count+sizeof(struct r3964_block_header), GFP_KERNEL);
    TRACE_M("r3964_write - kmalloc %x",(int)new_data);
@@ -1310,7 +1303,7 @@ static ssize_t r3964_write(struct tty_struct * tty, struct file * file,
       pHeader->owner = pClient;
    }
 
-   __copy_from_user(pHeader->data, data, count); /* We already verified this */
+   memcpy(pHeader->data, data, count); /* We already verified this */
 
    if(pInfo->flags & R3964_DEBUG)
    {