X-Git-Url: http://git.onelab.eu/?a=blobdiff_plain;f=drivers%2Fisdn%2Fact2000%2Fact2000_isa.c;h=b363d09764653b98dc197429f53303c6ebd117ca;hb=c7b5ebbddf7bcd3651947760f423e3783bbe6573;hp=662a61e67d6b0e96dbcc2477c1902255e22d04fd;hpb=5273a3df6485dc2ad6aa7ddd441b9a21970f003b;p=linux-2.6.git

diff --git a/drivers/isdn/act2000/act2000_isa.c b/drivers/isdn/act2000/act2000_isa.c
index 662a61e67..b363d0976 100644
--- a/drivers/isdn/act2000/act2000_isa.c
+++ b/drivers/isdn/act2000/act2000_isa.c
@@ -405,7 +405,7 @@ act2000_isa_getid(act2000_card * card)
  * Download microcode into card, check Firmware signature.
  */
 int
-act2000_isa_download(act2000_card * card, act2000_ddef * cb)
+act2000_isa_download(act2000_card * card, act2000_ddef __user * cb)
 {
         unsigned int length;
         int ret;
@@ -413,18 +413,18 @@ act2000_isa_download(act2000_card * card, act2000_ddef * cb)
         int c;
         long timeout;
         u_char *b;
-        u_char *p;
+        u_char __user *p;
         u_char *buf;
         act2000_ddef cblock;
 
         if (!act2000_isa_reset(card->port))
                 return -ENXIO;
         act2000_isa_delay(HZ / 2);
-        if(copy_from_user(&cblock, (char *) cb, sizeof(cblock)))
+        if(copy_from_user(&cblock, cb, sizeof(cblock)))
         	return -EFAULT;
         length = cblock.length;
         p = cblock.buffer;
-        if ((ret = verify_area(VERIFY_READ, (void *) p, length)))
+        if ((ret = verify_area(VERIFY_READ, p, length)))
                 return ret;
         buf = (u_char *) kmalloc(1024, GFP_KERNEL);
         if (!buf)
@@ -434,7 +434,10 @@ act2000_isa_download(act2000_card * card, act2000_ddef * cb)
                 l = (length > 1024) ? 1024 : length;
                 c = 0;
                 b = buf;
-                copy_from_user(buf, p, l);
+                if (copy_from_user(buf, p, l)) {
+                        kfree(buf);
+                        return -EFAULT;
+                }
                 while (c < l) {
                         if (act2000_isa_writeb(card, *b++)) {
                                 printk(KERN_WARNING