* framebuffer bugfix
@ 2004-04-09 16:56 Arjan van de Ven
0 siblings, 0 replies; only message in thread
From: Arjan van de Ven @ 2004-04-09 16:56 UTC (permalink / raw)
To: akpm; +Cc: linux-kernel
Hi,
patch below fixes a thinko in the frame buffer drivers;
the code does
cursor.image.data = kmalloc(size, GFP_KERNEL);
....
cursor.mask = kmalloc(size, GFP_KERNEL);
....
if (copy_from_user(&cursor.image.data, sprite->image.data, size) ||
copy_from_user(cursor.mask, sprite->mask, size)) {
....
where it's clear that the & in the first copy_from_user is utterly bogus
since the destination is the content of the newly allocated buffer, and not
the pointer to it as the code does....
--- linux-2.6.5/drivers/video/fbmem.c~ 2004-04-09 18:51:01.626902984 +0200
+++ linux-2.6.5/drivers/video/fbmem.c 2004-04-09 18:51:01.626902984 +0200
@@ -911,7 +911,7 @@
return -ENOMEM;
}
- if (copy_from_user(&cursor.image.data, sprite->image.data, size) ||
+ if (copy_from_user(cursor.image.data, sprite->image.data, size) ||
copy_from_user(cursor.mask, sprite->mask, size)) {
kfree(cursor.image.data);
kfree(cursor.mask);
^ permalink raw reply [flat|nested] only message in thread
only message in thread, other threads:[~2004-04-09 16:56 UTC | newest]
Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2004-04-09 16:56 framebuffer bugfix Arjan van de Ven
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®