From: Hollis Blanchard <hollisb@us.ibm.com>

Like radio-cadet.c, bw-qcam.c is calling copy_to_user() where it shouldn't.
The user buffer is copied to/from kernel space by
drivers/media/video/videodev.c:video_usercopy().