X-Git-Url: http://git.onelab.eu/?a=blobdiff_plain;f=drivers%2Fs390%2Fchar%2Fkeyboard.c;h=d4d2ff0a9da2003eb7ed8cd0d2b70dc0ae827c3b;hb=43bc926fffd92024b46cafaf7350d669ba9ca884;hp=fd43d99b45a3359382e17ebd208f643021352635;hpb=cee37fe97739d85991964371c1f3a745c00dd236;p=linux-2.6.git

diff --git a/drivers/s390/char/keyboard.c b/drivers/s390/char/keyboard.c
index fd43d99b4..d4d2ff0a9 100644
--- a/drivers/s390/char/keyboard.c
+++ b/drivers/s390/char/keyboard.c
@@ -50,14 +50,12 @@ kbd_alloc(void) {
 	struct kbd_data *kbd;
 	int i, len;
 
-	kbd = kmalloc(sizeof(struct kbd_data), GFP_KERNEL);
+	kbd = kzalloc(sizeof(struct kbd_data), GFP_KERNEL);
 	if (!kbd)
 		goto out;
-	memset(kbd, 0, sizeof(struct kbd_data));
-	kbd->key_maps = kmalloc(sizeof(key_maps), GFP_KERNEL);
-	if (!key_maps)
+	kbd->key_maps = kzalloc(sizeof(key_maps), GFP_KERNEL);
+	if (!kbd->key_maps)
 		goto out_kbd;
-	memset(kbd->key_maps, 0, sizeof(key_maps));
 	for (i = 0; i < ARRAY_SIZE(key_maps); i++) {
 		if (key_maps[i]) {
 			kbd->key_maps[i] =
@@ -68,10 +66,9 @@ kbd_alloc(void) {
 			       sizeof(u_short)*NR_KEYS);
 		}
 	}
-	kbd->func_table = kmalloc(sizeof(func_table), GFP_KERNEL);
+	kbd->func_table = kzalloc(sizeof(func_table), GFP_KERNEL);
 	if (!kbd->func_table)
 		goto out_maps;
-	memset(kbd->func_table, 0, sizeof(func_table));
 	for (i = 0; i < ARRAY_SIZE(func_table); i++) {
 		if (func_table[i]) {
 			len = strlen(func_table[i]) + 1;
@@ -82,10 +79,9 @@ kbd_alloc(void) {
 		}
 	}
 	kbd->fn_handler =
-		kmalloc(sizeof(fn_handler_fn *) * NR_FN_HANDLER, GFP_KERNEL);
+		kzalloc(sizeof(fn_handler_fn *) * NR_FN_HANDLER, GFP_KERNEL);
 	if (!kbd->fn_handler)
 		goto out_func;
-	memset(kbd->fn_handler, 0, sizeof(fn_handler_fn *) * NR_FN_HANDLER);
 	kbd->accent_table =
 		kmalloc(sizeof(struct kbdiacr)*MAX_DIACR, GFP_KERNEL);
 	if (!kbd->accent_table)
@@ -99,13 +95,11 @@ out_fn_handler:
 	kfree(kbd->fn_handler);
 out_func:
 	for (i = 0; i < ARRAY_SIZE(func_table); i++)
-		if (kbd->func_table[i])
-			kfree(kbd->func_table[i]);
+		kfree(kbd->func_table[i]);
 	kfree(kbd->func_table);
 out_maps:
 	for (i = 0; i < ARRAY_SIZE(key_maps); i++)
-		if (kbd->key_maps[i])
-			kfree(kbd->key_maps[i]);
+		kfree(kbd->key_maps[i]);
 	kfree(kbd->key_maps);
 out_kbd:
 	kfree(kbd);
@@ -121,12 +115,10 @@ kbd_free(struct kbd_data *kbd)
 	kfree(kbd->accent_table);
 	kfree(kbd->fn_handler);
 	for (i = 0; i < ARRAY_SIZE(func_table); i++)
-		if (kbd->func_table[i])
-			kfree(kbd->func_table[i]);
+		kfree(kbd->func_table[i]);
 	kfree(kbd->func_table);
 	for (i = 0; i < ARRAY_SIZE(key_maps); i++)
-		if (kbd->key_maps[i])
-			kfree(kbd->key_maps[i]);
+		kfree(kbd->key_maps[i]);
 	kfree(kbd->key_maps);
 	kfree(kbd);
 }
@@ -444,7 +436,11 @@ do_kdgkb_ioctl(struct kbd_data *kbd, struct kbsentry __user *u_kbs,
 			return -EPERM;
 		len = strnlen_user(u_kbs->kb_string,
 				   sizeof(u_kbs->kb_string) - 1);
-		p = kmalloc(len, GFP_KERNEL);
+		if (!len)
+			return -EFAULT;
+		if (len > sizeof(u_kbs->kb_string) - 1)
+			return -EINVAL;
+		p = kmalloc(len + 1, GFP_KERNEL);
 		if (!p)
 			return -ENOMEM;
 		if (copy_from_user(p, u_kbs->kb_string, len)) {
@@ -452,8 +448,7 @@ do_kdgkb_ioctl(struct kbd_data *kbd, struct kbsentry __user *u_kbs,
 			return -EFAULT;
 		}
 		p[len] = 0;
-		if (kbd->func_table[kb_func])
-			kfree(kbd->func_table[kb_func]);
+		kfree(kbd->func_table[kb_func]);
 		kbd->func_table[kb_func] = p;
 		break;
 	}