mousedev uses userspace pointers without copy_{to,from}_user

From: David Woodhouse (dwmw2@infradead.org)
Date: Fri Oct 27 2000 - 08:17:51 EST


static ssize_t mousedev_write(struct file * file, const char * buffer, size_t count, loff_t *ppos)
{
        struct mousedev_list *list = file->private_data;
        unsigned char c;
        int i;

        for (i = 0; i < count; i++) {

                c = buffer[i];

oops. Can we make this die horribly on x86, just for a few kernel releases?
Along with turning on spinlock debugging, which would have shown up the USB
audio problem months ago.

--
dwmw2

- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org Please read the FAQ at http://www.tux.org/lkml/



This archive was generated by hypermail 2b29 : Tue Oct 31 2000 - 21:00:20 EST