|
@@ -1615,17 +1615,14 @@ static int rr_ioctl(struct net_device *dev, struct ifreq *rq, int cmd)
|
|
return -EPERM;
|
|
return -EPERM;
|
|
}
|
|
}
|
|
|
|
|
|
- image = kmalloc(EEPROM_WORDS * sizeof(u32), GFP_KERNEL);
|
|
|
|
- oldimage = kmalloc(EEPROM_WORDS * sizeof(u32), GFP_KERNEL);
|
|
|
|
- if (!image || !oldimage) {
|
|
|
|
- error = -ENOMEM;
|
|
|
|
- goto wf_out;
|
|
|
|
- }
|
|
|
|
|
|
+ image = memdup_user(rq->ifr_data, EEPROM_BYTES);
|
|
|
|
+ if (IS_ERR(image))
|
|
|
|
+ return PTR_ERR(image);
|
|
|
|
|
|
- error = copy_from_user(image, rq->ifr_data, EEPROM_BYTES);
|
|
|
|
- if (error) {
|
|
|
|
- error = -EFAULT;
|
|
|
|
- goto wf_out;
|
|
|
|
|
|
+ oldimage = kmalloc(EEPROM_BYTES, GFP_KERNEL);
|
|
|
|
+ if (!oldimage) {
|
|
|
|
+ kfree(image);
|
|
|
|
+ return -ENOMEM;
|
|
}
|
|
}
|
|
|
|
|
|
if (rrpriv->fw_running){
|
|
if (rrpriv->fw_running){
|