From 44e5211fdd3b5d93a861ad6cd8dd87c50aadb2cb Mon Sep 17 00:00:00 2001
From: Thomas Meyer <thomas@m3y3r.de>
Date: Thu, 12 Jan 2012 20:32:04 +0100
Subject: [PATCH] --- yaml --- r: 284611 b: refs/heads/master c:
 a699ed6f1f977dcc4a49452a247cf21dc9cec3f9 h: refs/heads/master i:   284609:
 a8e30472b85f6b7a05d4a728a12330ee2a30acb7   284607:
 ee516fc7c355b8678ee37021634d0021d66fb9df v: v3

---
 [refs]                      |  2 +-
 trunk/drivers/i2c/i2c-dev.c | 13 ++++---------
 2 files changed, 5 insertions(+), 10 deletions(-)

diff --git a/[refs] b/[refs]
index 77d38032f525..f3508b035487 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: 3527bd5045aacb4e4072f9cacb8eb9a433fbad39
+refs/heads/master: a699ed6f1f977dcc4a49452a247cf21dc9cec3f9
diff --git a/trunk/drivers/i2c/i2c-dev.c b/trunk/drivers/i2c/i2c-dev.c
index 57a45ce84b2d..10e7f1e76586 100644
--- a/trunk/drivers/i2c/i2c-dev.c
+++ b/trunk/drivers/i2c/i2c-dev.c
@@ -251,15 +251,10 @@ static noinline int i2cdev_ioctl_rdrw(struct i2c_client *client,
 	if (rdwr_arg.nmsgs > I2C_RDRW_IOCTL_MAX_MSGS)
 		return -EINVAL;
 
-	rdwr_pa = kmalloc(rdwr_arg.nmsgs * sizeof(struct i2c_msg), GFP_KERNEL);
-	if (!rdwr_pa)
-		return -ENOMEM;
-
-	if (copy_from_user(rdwr_pa, rdwr_arg.msgs,
-			   rdwr_arg.nmsgs * sizeof(struct i2c_msg))) {
-		kfree(rdwr_pa);
-		return -EFAULT;
-	}
+	rdwr_pa = memdup_user(rdwr_arg.msgs,
+			      rdwr_arg.nmsgs * sizeof(struct i2c_msg));
+	if (IS_ERR(rdwr_pa))
+		return PTR_ERR(rdwr_pa);
 
 	data_ptrs = kmalloc(rdwr_arg.nmsgs * sizeof(u8 __user *), GFP_KERNEL);
 	if (data_ptrs == NULL) {