Skip to content

Commit

Permalink
[MTD] mtdchar: Fix MEMGETOOBSEL and ECCGETLAYOUT ioctls
Browse files Browse the repository at this point in the history
1. The ECCGETLAYOUT ioctl copy_to_user() call has a superfluous '&'
causing the resulting information to be garbage rather than the intended
mtd->ecclayout.

2. The MEMGETOOBSEL misses copying mtd->ecclayout->eccbytes so the
resulting field of the returned structure contains garbage.

Signed-off-by: Ricard Wanderlöf <ricardw@axis.com>
Signed-off-by: David Woodhouse <dwmw2@infradead.org>
  • Loading branch information
Ricard Wanderlöf authored and David Woodhouse committed Oct 21, 2006
1 parent 42cb140 commit d25ade7
Showing 1 changed file with 2 additions and 1 deletion.
3 changes: 2 additions & 1 deletion drivers/mtd/mtdchar.c
Original file line number Diff line number Diff line change
Expand Up @@ -616,6 +616,7 @@ static int mtd_ioctl(struct inode *inode, struct file *file,
memcpy(&oi.eccpos, mtd->ecclayout->eccpos, sizeof(oi.eccpos));
memcpy(&oi.oobfree, mtd->ecclayout->oobfree,
sizeof(oi.oobfree));
oi.eccbytes = mtd->ecclayout->eccbytes;

if (copy_to_user(argp, &oi, sizeof(struct nand_oobinfo)))
return -EFAULT;
Expand Down Expand Up @@ -715,7 +716,7 @@ static int mtd_ioctl(struct inode *inode, struct file *file,
if (!mtd->ecclayout)
return -EOPNOTSUPP;

if (copy_to_user(argp, &mtd->ecclayout,
if (copy_to_user(argp, mtd->ecclayout,
sizeof(struct nand_ecclayout)))
return -EFAULT;
break;
Expand Down

0 comments on commit d25ade7

Please sign in to comment.