[PATCH] bad userspace dereferencing

drivers/char/machzwd.c

@@ -329,7 +329,10 @@ static ssize_t zf_write(struct file *file, const char *buf, size_t count,
 			
 			/* now scan */
 			for(ofs = 0; ofs != count; ofs++){
-				if(buf[ofs] == 'V'){
+				char c;
+				if (get_user(c, buf + ofs))
+					return -EFAULT;
+				if (c == 'V'){
 					zf_expect_close = 1;
 					dprintk("zf_expect_close 1\n");
 				}

drivers/char/w83877f_wdt.c

@@ -192,8 +192,13 @@ static ssize_t fop_write(struct file * file, const char * buf, size_t count, lof
 
 		/* now scan */
 		for(ofs = 0; ofs != count; ofs++)
-			if(buf[ofs] == 'V')
+		{
+			char c;
+			if (get_user(c, buf + ofs))
+				return -EFAULT;
+			if (c == 'V')
 				wdt_expect_close = 1;
+		}
 
 		/* someone wrote to us, we should restart timer */
 		next_heartbeat = jiffies + WDT_HEARTBEAT;