On Sun, May 23, 2004 at 10:44:15AM +0200, Willy Tarreau wrote:
> Hi Arjan,
> 
> On Sun, May 23, 2004 at 09:13:20AM +0200, Arjan van de Ven wrote:
> > on first look it seems to be missing a bunch of get_user() calls and
> > does direct access instead....
> 
> It was intentional for speed purpose. The areas are checked once with
> verify_area() when we need to access memory, then data is copied directly
> from/to memory. I don't think there's any risk, but I can be wrong.

it's an oopsable offence; nothing is making sure the memory is actually
present for example.