From f04596a663c6a06e6dcb42884c29d027bb384566 Mon Sep 17 00:00:00 2001
From: Dan Carpenter <error27@gmail.com>
Date: Tue, 9 Aug 2011 12:52:38 -0300
Subject: [PATCH] --- yaml --- r: 271716 b: refs/heads/master c:
 e9013fb6eb397df9fd2e71d4f31a8bad4e65d046 h: refs/heads/master v: v3

---
 [refs]                                        |  2 +-
 .../media/dvb/ddbridge/ddbridge-core.c        | 34 +++++++++----------
 2 files changed, 18 insertions(+), 18 deletions(-)

diff --git a/[refs] b/[refs]
index ebc1d80b8e5e..ece1fade41aa 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: 0db4bf42baae95ddd457b0c4911e851c9169750e
+refs/heads/master: e9013fb6eb397df9fd2e71d4f31a8bad4e65d046
diff --git a/trunk/drivers/media/dvb/ddbridge/ddbridge-core.c b/trunk/drivers/media/dvb/ddbridge/ddbridge-core.c
index 573d540f213e..fe56703cecfb 100644
--- a/trunk/drivers/media/dvb/ddbridge/ddbridge-core.c
+++ b/trunk/drivers/media/dvb/ddbridge/ddbridge-core.c
@@ -1438,7 +1438,7 @@ static long ddb_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
 {
 	struct ddb *dev = file->private_data;
 	void *parg = (void *)arg;
-	int res = -EFAULT;
+	int res;
 
 	switch (cmd) {
 	case IOCTL_DDB_FLASHIO:
@@ -1447,29 +1447,29 @@ static long ddb_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
 		u8 *rbuf, *wbuf;
 
 		if (copy_from_user(&fio, parg, sizeof(fio)))
-			break;
-		if (fio.write_len + fio.read_len > 1028) {
-			printk(KERN_ERR "IOBUF too small\n");
-			return -ENOMEM;
-		}
+			return -EFAULT;
+
+		if (fio.write_len > 1028 || fio.read_len > 1028)
+			return -EINVAL;
+		if (fio.write_len + fio.read_len > 1028)
+			return -EINVAL;
+
 		wbuf = &dev->iobuf[0];
-		if (!wbuf)
-			return -ENOMEM;
 		rbuf = wbuf + fio.write_len;
-		if (copy_from_user(wbuf, fio.write_buf, fio.write_len)) {
-			vfree(wbuf);
-			break;
-		}
-		res = flashio(dev, wbuf, fio.write_len,
-			      rbuf, fio.read_len);
+
+		if (copy_from_user(wbuf, fio.write_buf, fio.write_len))
+			return -EFAULT;
+		res = flashio(dev, wbuf, fio.write_len, rbuf, fio.read_len);
+		if (res)
+			return res;
 		if (copy_to_user(fio.read_buf, rbuf, fio.read_len))
-			res = -EFAULT;
+			return -EFAULT;
 		break;
 	}
 	default:
-		break;
+		return -ENOTTY;
 	}
-	return res;
+	return 0;
 }
 
 static const struct file_operations ddb_fops = {