Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S265053AbTFCPmC (ORCPT ); Tue, 3 Jun 2003 11:42:02 -0400 Received: (majordomo@vger.kernel.org) by vger.kernel.org id S265055AbTFCPmB (ORCPT ); Tue, 3 Jun 2003 11:42:01 -0400 Received: from e31.co.us.ibm.com ([32.97.110.129]:63913 "EHLO e31.co.us.ibm.com") by vger.kernel.org with ESMTP id S265053AbTFCPmA (ORCPT ); Tue, 3 Jun 2003 11:42:00 -0400 Date: Tue, 3 Jun 2003 10:55:21 -0500 Subject: [CHECKER][PATCH] bw-qcam.c bad copy_to_user Content-Type: multipart/mixed; boundary=Apple-Mail-4--960889775 Mime-Version: 1.0 (Apple Message framework v552) Cc: linux-kernel@vger.kernel.org To: Linus Torvalds From: Hollis Blanchard Message-Id: X-Mailer: Apple Mail (2.552) Sender: linux-kernel-owner@vger.kernel.org X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1266 Lines: 43 --Apple-Mail-4--960889775 Content-Transfer-Encoding: 7bit Content-Type: text/plain; charset=US-ASCII; format=flowed Like radio-cadet.c, bw-qcam.c is calling copy_to_user() where it shouldn't. The user buffer is copied to/from kernel space by drivers/media/video/videodev.c:video_usercopy() . Please apply. -- Hollis Blanchard IBM Linux Technology Center --Apple-Mail-4--960889775 Content-Disposition: attachment; filename=bwqcam-copy_to_user.txt Content-Transfer-Encoding: 7bit Content-Type: text/plain; x-unix-mode=0644; name="bwqcam-copy_to_user.txt" ===== drivers/media/video/bw-qcam.c 1.11 vs edited ===== --- 1.11/drivers/media/video/bw-qcam.c Sun Feb 16 18:16:53 2003 +++ edited/drivers/media/video/bw-qcam.c Tue Jun 3 10:28:29 2003 @@ -723,8 +723,6 @@ /* Good question.. its composite or SVHS so.. */ v->type = VIDEO_TYPE_CAMERA; strcpy(v->name, "Camera"); - if(copy_to_user(arg, &v, sizeof(v))) - return -EFAULT; return 0; } case VIDIOCSCHAN: --Apple-Mail-4--960889775-- - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/