diff options
| -rw-r--r-- | package/kernel/lantiq/ltq-adsl-mei/src/drv_mei_cpe.c | 8 |
1 files changed, 6 insertions, 2 deletions
diff --git a/package/kernel/lantiq/ltq-adsl-mei/src/drv_mei_cpe.c b/package/kernel/lantiq/ltq-adsl-mei/src/drv_mei_cpe.c index 2339d919b6..8ccfb443ed 100644 --- a/package/kernel/lantiq/ltq-adsl-mei/src/drv_mei_cpe.c +++ b/package/kernel/lantiq/ltq-adsl-mei/src/drv_mei_cpe.c @@ -1620,7 +1620,9 @@ DSL_BSP_FWDownload (DSL_DEV_Device_t * pDev, const char *buf, IFX_MEI_EMSG ("Firmware size is too small!\n"); return retval; } - copy_from_user ((char *) &img_hdr_tmp, buf, sizeof (img_hdr_tmp)); + if (copy_from_user ((char *) &img_hdr_tmp, buf, sizeof (img_hdr_tmp))) + return -EFAULT; + // header of image_size and crc are not included. DSL_DEV_PRIVATE(pDev)->image_size = le32_to_cpu (img_hdr_tmp.size) + 8; @@ -1698,7 +1700,9 @@ DSL_BSP_FWDownload (DSL_DEV_Device_t * pDev, const char *buf, nCopy = SDRAM_SEGMENT_SIZE - offset; else nCopy = size - nRead; - copy_from_user (mem_ptr, buf + nRead, nCopy); + if (copy_from_user (mem_ptr, buf + nRead, nCopy)) + return -EFAULT; + for (offset = 0; offset < (nCopy / 4); offset++) { ((unsigned long *) mem_ptr)[offset] = le32_to_cpu (((unsigned long *) mem_ptr)[offset]); } |