diff options
| -rw-r--r-- | drivers/staging/ced1401/ced_ioc.c | 28 |
1 files changed, 17 insertions, 11 deletions
diff --git a/drivers/staging/ced1401/ced_ioc.c b/drivers/staging/ced1401/ced_ioc.c index 5813aee..0adba75 100644 --- a/drivers/staging/ced1401/ced_ioc.c +++ b/drivers/staging/ced1401/ced_ioc.c @@ -913,18 +913,24 @@ int GetTransfer(DEVICE_EXTENSION * pdx, TGET_TX_BLOCK __user * pTX) iReturn = U14ERR_BADAREA; else { // Return the best information we have - we don't have physical addresses - TGET_TX_BLOCK tx; - memset(&tx, 0, sizeof(tx)); // clean out local work structure - tx.size = pdx->rTransDef[dwIdent].dwLength; - tx.linear = (long long)((long)pdx->rTransDef[dwIdent].lpvBuff); - tx.avail = GET_TX_MAXENTRIES; // how many blocks we could return - tx.used = 1; // number we actually return - tx.entries[0].physical = - (long long)(tx.linear + pdx->StagedOffset); - tx.entries[0].size = tx.size; - - if (copy_to_user(pTX, &tx, sizeof(tx))) + TGET_TX_BLOCK *tx; + + tx = kzalloc(sizeof(*tx), GFP_KERNEL); + if (!tx) { + mutex_unlock(&pdx->io_mutex); + return -ENOMEM; + } + tx->size = pdx->rTransDef[dwIdent].dwLength; + tx->linear = (long long)((long)pdx->rTransDef[dwIdent].lpvBuff); + tx->avail = GET_TX_MAXENTRIES; // how many blocks we could return + tx->used = 1; // number we actually return + tx->entries[0].physical = + (long long)(tx->linear + pdx->StagedOffset); + tx->entries[0].size = tx->size; + + if (copy_to_user(pTX, tx, sizeof(*tx))) iReturn = -EFAULT; + kfree(tx); } mutex_unlock(&pdx->io_mutex); return iReturn; |