patch-2_6_7-vs1_9_1_12

[linux-2.6.git] / sound / oss / opl3.c

diff --git a/sound/oss/opl3.c b/sound/oss/opl3.c
index cc9ce47..9789c5a 100644 (file)
--- a/sound/oss/opl3.c
+++ b/sound/oss/opl3.c
@@ -110,7 +110,7 @@ static void enter_4op_mode(void)
        devc->v_alloc->max_voice = devc->nr_voice = 12;
 }
 
-static int opl3_ioctl(int dev, unsigned int cmd, caddr_t arg)
+static int opl3_ioctl(int dev, unsigned int cmd, void __user * arg)
 {
        struct sbi_instrument ins;
        
@@ -822,7 +822,7 @@ static void opl3_hw_control(int dev, unsigned char *event)
 {
 }
 
-static int opl3_load_patch(int dev, int format, const char *addr,
+static int opl3_load_patch(int dev, int format, const char __user *addr,
                int offs, int count, int pmgr_flag)
 {
        struct sbi_instrument ins;
@@ -833,7 +833,11 @@ static int opl3_load_patch(int dev, int format, const char *addr,
                return -EINVAL;
        }
 
-       if(copy_from_user(&((char *) &ins)[offs], &(addr)[offs], sizeof(ins) - offs))
+       /*
+        * What the fuck is going on here?  We leave junk in the beginning
+        * of ins and then check the field pretty close to that beginning?
+        */
+       if(copy_from_user(&((char *) &ins)[offs], addr + offs, sizeof(ins) - offs))
                return -EFAULT;
 
        if (ins.channel < 0 || ins.channel >= SBFM_MAXINSTR)