[MTD] mtdchar: Fix MEMGETOOBSEL and ECCGETLAYOUT ioctls
authorRicard Wanderlöf <ricard.wanderlof@axis.com>
Tue, 17 Oct 2006 15:27:11 +0000 (17:27 +0200)
committerDavid Woodhouse <dwmw2@infradead.org>
Sat, 21 Oct 2006 15:33:17 +0000 (16:33 +0100)
1. The ECCGETLAYOUT ioctl copy_to_user() call has a superfluous '&'
causing the resulting information to be garbage rather than the intended
mtd->ecclayout.

2. The MEMGETOOBSEL misses copying mtd->ecclayout->eccbytes so the
resulting field of the returned structure contains garbage.

Signed-off-by: Ricard Wanderlöf <ricardw@axis.com>
Signed-off-by: David Woodhouse <dwmw2@infradead.org>
drivers/mtd/mtdchar.c

index 5b6acfcb2b880be00cc77be7abafbf0c71b264da..866c8e0d57e4c331c49b0781a146e0f9f128de34 100644 (file)
@@ -616,6 +616,7 @@ static int mtd_ioctl(struct inode *inode, struct file *file,
                memcpy(&oi.eccpos, mtd->ecclayout->eccpos, sizeof(oi.eccpos));
                memcpy(&oi.oobfree, mtd->ecclayout->oobfree,
                       sizeof(oi.oobfree));
+               oi.eccbytes = mtd->ecclayout->eccbytes;
 
                if (copy_to_user(argp, &oi, sizeof(struct nand_oobinfo)))
                        return -EFAULT;
@@ -715,7 +716,7 @@ static int mtd_ioctl(struct inode *inode, struct file *file,
                if (!mtd->ecclayout)
                        return -EOPNOTSUPP;
 
-               if (copy_to_user(argp, &mtd->ecclayout,
+               if (copy_to_user(argp, mtd->ecclayout,
                                 sizeof(struct nand_ecclayout)))
                        return -EFAULT;
                break;