X-Git-Url: https://git.openpandora.org/cgi-bin/gitweb.cgi?a=blobdiff_plain;f=drivers%2Fs390%2Fchar%2Fkeyboard.c;h=d4d2ff0a9da2003eb7ed8cd0d2b70dc0ae827c3b;hb=7c8ce71b092425f1e938285cab2a679c09444d9b;hp=5bda2340a39d93a843fd1f090da240f0d1c6af36;hpb=8e33ba49765484bc6de3a2f8143733713fa93bc1;p=pandora-kernel.git

diff --git a/drivers/s390/char/keyboard.c b/drivers/s390/char/keyboard.c
index 5bda2340a39d..d4d2ff0a9da2 100644
--- a/drivers/s390/char/keyboard.c
+++ b/drivers/s390/char/keyboard.c
@@ -50,14 +50,12 @@ kbd_alloc(void) {
 	struct kbd_data *kbd;
 	int i, len;
 
-	kbd = kmalloc(sizeof(struct kbd_data), GFP_KERNEL);
+	kbd = kzalloc(sizeof(struct kbd_data), GFP_KERNEL);
 	if (!kbd)
 		goto out;
-	memset(kbd, 0, sizeof(struct kbd_data));
-	kbd->key_maps = kmalloc(sizeof(key_maps), GFP_KERNEL);
-	if (!key_maps)
+	kbd->key_maps = kzalloc(sizeof(key_maps), GFP_KERNEL);
+	if (!kbd->key_maps)
 		goto out_kbd;
-	memset(kbd->key_maps, 0, sizeof(key_maps));
 	for (i = 0; i < ARRAY_SIZE(key_maps); i++) {
 		if (key_maps[i]) {
 			kbd->key_maps[i] =
@@ -68,10 +66,9 @@ kbd_alloc(void) {
 			       sizeof(u_short)*NR_KEYS);
 		}
 	}
-	kbd->func_table = kmalloc(sizeof(func_table), GFP_KERNEL);
+	kbd->func_table = kzalloc(sizeof(func_table), GFP_KERNEL);
 	if (!kbd->func_table)
 		goto out_maps;
-	memset(kbd->func_table, 0, sizeof(func_table));
 	for (i = 0; i < ARRAY_SIZE(func_table); i++) {
 		if (func_table[i]) {
 			len = strlen(func_table[i]) + 1;
@@ -82,10 +79,9 @@ kbd_alloc(void) {
 		}
 	}
 	kbd->fn_handler =
-		kmalloc(sizeof(fn_handler_fn *) * NR_FN_HANDLER, GFP_KERNEL);
+		kzalloc(sizeof(fn_handler_fn *) * NR_FN_HANDLER, GFP_KERNEL);
 	if (!kbd->fn_handler)
 		goto out_func;
-	memset(kbd->fn_handler, 0, sizeof(fn_handler_fn *) * NR_FN_HANDLER);
 	kbd->accent_table =
 		kmalloc(sizeof(struct kbdiacr)*MAX_DIACR, GFP_KERNEL);
 	if (!kbd->accent_table)
@@ -440,7 +436,11 @@ do_kdgkb_ioctl(struct kbd_data *kbd, struct kbsentry __user *u_kbs,
 			return -EPERM;
 		len = strnlen_user(u_kbs->kb_string,
 				   sizeof(u_kbs->kb_string) - 1);
-		p = kmalloc(len, GFP_KERNEL);
+		if (!len)
+			return -EFAULT;
+		if (len > sizeof(u_kbs->kb_string) - 1)
+			return -EINVAL;
+		p = kmalloc(len + 1, GFP_KERNEL);
 		if (!p)
 			return -ENOMEM;
 		if (copy_from_user(p, u_kbs->kb_string, len)) {