diff options
Diffstat (limited to 'drivers/rapidio')
| -rw-r--r-- | drivers/rapidio/devices/rio_mport_cdev.c | 3 | ||||
| -rw-r--r-- | drivers/rapidio/rio_cm.c | 15 |
2 files changed, 7 insertions, 11 deletions
diff --git a/drivers/rapidio/devices/rio_mport_cdev.c b/drivers/rapidio/devices/rio_mport_cdev.c index 436dfe871d32..9013a585507e 100644 --- a/drivers/rapidio/devices/rio_mport_cdev.c +++ b/drivers/rapidio/devices/rio_mport_cdev.c @@ -892,7 +892,8 @@ rio_dma_transfer(struct file *filp, u32 transfer_mode, down_read(¤t->mm->mmap_sem); pinned = get_user_pages( (unsigned long)xfer->loc_addr & PAGE_MASK, - nr_pages, dir == DMA_FROM_DEVICE, 0, + nr_pages, + dir == DMA_FROM_DEVICE ? FOLL_WRITE : 0, page_list, NULL); up_read(¤t->mm->mmap_sem); diff --git a/drivers/rapidio/rio_cm.c b/drivers/rapidio/rio_cm.c index cebc296463ad..bad0e0ea4f30 100644 --- a/drivers/rapidio/rio_cm.c +++ b/drivers/rapidio/rio_cm.c @@ -1841,24 +1841,19 @@ static int cm_chan_msg_send(void __user *arg) { struct rio_cm_msg msg; void *buf; - int ret = 0; + int ret; if (copy_from_user(&msg, arg, sizeof(msg))) return -EFAULT; if (msg.size > RIO_MAX_MSG_SIZE) return -EINVAL; - buf = kmalloc(msg.size, GFP_KERNEL); - if (!buf) - return -ENOMEM; - - if (copy_from_user(buf, (void __user *)(uintptr_t)msg.msg, msg.size)) { - ret = -EFAULT; - goto out; - } + buf = memdup_user((void __user *)(uintptr_t)msg.msg, msg.size); + if (IS_ERR(buf)) + return PTR_ERR(buf); ret = riocm_ch_send(msg.ch_num, buf, msg.size); -out: + kfree(buf); return ret; } |
