From: Dipankar Sarma <dipankar@in.ibm.com>

Use copy_to_user, not memcpy with user buffers



 25-akpm/drivers/isdn/eicon/linchr.c |   12 +++++-------
 1 files changed, 5 insertions(+), 7 deletions(-)

diff -puN drivers/isdn/eicon/linchr.c~ds-05-eicon-usercopy-fix drivers/isdn/eicon/linchr.c
--- 25/drivers/isdn/eicon/linchr.c~ds-05-eicon-usercopy-fix	Tue Jun 10 14:56:26 2003
+++ 25-akpm/drivers/isdn/eicon/linchr.c	Tue Jun 10 14:56:47 2003
@@ -153,17 +153,15 @@ ssize_t do_read(struct file *pFile, char
 	klog_t *pHeadItem;
 
 	if (BufferSize < sizeof(klog_t))
-	{
-		printk(KERN_WARNING "Divas: Divalog buffer specifed a size that is too small (%d - %d required)\n",
-			BufferSize, sizeof(klog_t));
 		return -EIO;
-	}
 
 	pHeadItem = (klog_t *) DivasLogFifoRead();
 
-	if (pHeadItem)
-	{
-		memcpy(pClientLogBuffer, pHeadItem, sizeof(klog_t));
+	if (pHeadItem) {
+		if (copy_to_user(pClientLogBuffer, pHeadItem, sizeof(klog_t))) {
+			kfree(pHeadItem);
+			return -EFAULT;
+		}
 		kfree(pHeadItem);
 		return sizeof(klog_t);
 	}

_