|
@@ -251,15 +251,10 @@ static noinline int i2cdev_ioctl_rdrw(struct i2c_client *client,
|
|
|
if (rdwr_arg.nmsgs > I2C_RDRW_IOCTL_MAX_MSGS)
|
|
|
return -EINVAL;
|
|
|
|
|
|
- rdwr_pa = kmalloc(rdwr_arg.nmsgs * sizeof(struct i2c_msg), GFP_KERNEL);
|
|
|
- if (!rdwr_pa)
|
|
|
- return -ENOMEM;
|
|
|
-
|
|
|
- if (copy_from_user(rdwr_pa, rdwr_arg.msgs,
|
|
|
- rdwr_arg.nmsgs * sizeof(struct i2c_msg))) {
|
|
|
- kfree(rdwr_pa);
|
|
|
- return -EFAULT;
|
|
|
- }
|
|
|
+ rdwr_pa = memdup_user(rdwr_arg.msgs,
|
|
|
+ rdwr_arg.nmsgs * sizeof(struct i2c_msg));
|
|
|
+ if (IS_ERR(rdwr_pa))
|
|
|
+ return PTR_ERR(rdwr_pa);
|
|
|
|
|
|
data_ptrs = kmalloc(rdwr_arg.nmsgs * sizeof(u8 __user *), GFP_KERNEL);
|
|
|
if (data_ptrs == NULL) {
|