提交 d25ade71 编写于 作者: R Ricard Wanderlöf 提交者: David Woodhouse

[MTD] mtdchar: Fix MEMGETOOBSEL and ECCGETLAYOUT ioctls

1. The ECCGETLAYOUT ioctl copy_to_user() call has a superfluous '&'
causing the resulting information to be garbage rather than the intended
mtd->ecclayout.

2. The MEMGETOOBSEL misses copying mtd->ecclayout->eccbytes so the
resulting field of the returned structure contains garbage.
Signed-off-by: NRicard Wanderlöf <ricardw@axis.com>
Signed-off-by: NDavid Woodhouse <dwmw2@infradead.org>
上级 42cb1403
...@@ -616,6 +616,7 @@ static int mtd_ioctl(struct inode *inode, struct file *file, ...@@ -616,6 +616,7 @@ static int mtd_ioctl(struct inode *inode, struct file *file,
memcpy(&oi.eccpos, mtd->ecclayout->eccpos, sizeof(oi.eccpos)); memcpy(&oi.eccpos, mtd->ecclayout->eccpos, sizeof(oi.eccpos));
memcpy(&oi.oobfree, mtd->ecclayout->oobfree, memcpy(&oi.oobfree, mtd->ecclayout->oobfree,
sizeof(oi.oobfree)); sizeof(oi.oobfree));
oi.eccbytes = mtd->ecclayout->eccbytes;
if (copy_to_user(argp, &oi, sizeof(struct nand_oobinfo))) if (copy_to_user(argp, &oi, sizeof(struct nand_oobinfo)))
return -EFAULT; return -EFAULT;
...@@ -715,7 +716,7 @@ static int mtd_ioctl(struct inode *inode, struct file *file, ...@@ -715,7 +716,7 @@ static int mtd_ioctl(struct inode *inode, struct file *file,
if (!mtd->ecclayout) if (!mtd->ecclayout)
return -EOPNOTSUPP; return -EOPNOTSUPP;
if (copy_to_user(argp, &mtd->ecclayout, if (copy_to_user(argp, mtd->ecclayout,
sizeof(struct nand_ecclayout))) sizeof(struct nand_ecclayout)))
return -EFAULT; return -EFAULT;
break; break;
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册