Like radio-cadet.c, bw-qcam.c is calling copy_to_user() where it
shouldn't. The user buffer is copied to/from kernel space by
drivers/media/video/videodev.c:video_usercopy() . Please apply.
-- Hollis Blanchard IBM Linux Technology Center
===== drivers/media/video/bw-qcam.c 1.11 vs edited ===== --- 1.11/drivers/media/video/bw-qcam.c Sun Feb 16 18:16:53 2003 +++ edited/drivers/media/video/bw-qcam.c Tue Jun 3 10:28:29 2003 @@ -723,8 +723,6 @@ /* Good question.. its composite or SVHS so.. */ v->type = VIDEO_TYPE_CAMERA; strcpy(v->name, "Camera"); - if(copy_to_user(arg, &v, sizeof(v))) - return -EFAULT; return 0; } case VIDIOCSCHAN:
- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
This archive was generated by hypermail 2b29 : Sat Jun 07 2003 - 22:00:20 EST