Commit ebd913f0 authored by Andrew Morton's avatar Andrew Morton Committed by David Mosberger

[PATCH] fix bw-qcam.c bad copy_to_user

From: Hollis Blanchard <hollisb@us.ibm.com>

Like radio-cadet.c, bw-qcam.c is calling copy_to_user() where it shouldn't.
The user buffer is copied to/from kernel space by
drivers/media/video/videodev.c:video_usercopy().
parent 55e3bcda
...@@ -723,8 +723,6 @@ static int qcam_do_ioctl(struct inode *inode, struct file *file, ...@@ -723,8 +723,6 @@ static int qcam_do_ioctl(struct inode *inode, struct file *file,
/* Good question.. its composite or SVHS so.. */ /* Good question.. its composite or SVHS so.. */
v->type = VIDEO_TYPE_CAMERA; v->type = VIDEO_TYPE_CAMERA;
strcpy(v->name, "Camera"); strcpy(v->name, "Camera");
if(copy_to_user(arg, &v, sizeof(v)))
return -EFAULT;
return 0; return 0;
} }
case VIDIOCSCHAN: case VIDIOCSCHAN:
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment