From 0f6afe815b1b3f920f3502be654c848bdfe5ef38 Mon Sep 17 00:00:00 2001 From: Ayaz Ahmad Date: Tue, 8 Oct 2013 15:56:04 +0530 Subject: radio: iris: Use kernel API to copy data from user space Use copy_from_user kernel api to copy any data from user space to kernel space. Change-Id: Ia3b7bb0f98180bd8792c1c18e930cb5609b8dc82 CRs-Fixed: 540320 Signed-off-by: Ayaz Ahmad --- drivers/media/radio/radio-iris.c | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-) diff --git a/drivers/media/radio/radio-iris.c b/drivers/media/radio/radio-iris.c index a554749..3bac006 100644 --- a/drivers/media/radio/radio-iris.c +++ b/drivers/media/radio/radio-iris.c @@ -3623,13 +3623,21 @@ static int iris_vidioc_s_ctrl(struct file *file, void *priv, break; case V4L2_CID_PRIVATE_IRIS_RIVA_POKE: if (radio->riva_data_req.cmd_params.length <= MAX_RIVA_PEEK_RSP_SIZE) { - memcpy(radio->riva_data_req.data, (void *)ctrl->value, + retval = copy_from_user(radio->riva_data_req.data, + (void *)ctrl->value, radio->riva_data_req.cmd_params.length); - radio->riva_data_req.cmd_params.subopcode = RIVA_POKE_OPCODE; - retval = hci_poke_data(&radio->riva_data_req , radio->fm_hdev); + if (retval == 0) { + radio->riva_data_req.cmd_params.subopcode = + RIVA_POKE_OPCODE; + retval = hci_poke_data(&radio->riva_data_req, + radio->fm_hdev); + } else { + retval = -EINVAL; + } } else { FMDERR("Can not copy into driver's buffer. Length %d is more than" - "the buffer size %d\n", ctrl->value, MAX_RIVA_PEEK_RSP_SIZE); + "the buffer size %d\n", radio->riva_data_req.cmd_params.length, + MAX_RIVA_PEEK_RSP_SIZE); retval = -EINVAL; } break; -- cgit v1.1