From: "Antonino A. Daplas" Here's a patch that makes sure the return value of copy_from/to_user gets checked and handled in drivers/video/kyro/fbdev.c It also updates a comment at the top of the file that lists the files name and location. Signed-off-by: Jesper Juhl Signed-off-by: Antonino Daplas Signed-off-by: Andrew Morton --- 25-akpm/drivers/video/kyro/fbdev.c | 19 ++++++++++++------- 1 files changed, 12 insertions(+), 7 deletions(-) diff -puN drivers/video/kyro/fbdev.c~kyrofb-copy__user-return-value-checks-added-to-kyro-fb drivers/video/kyro/fbdev.c --- 25/drivers/video/kyro/fbdev.c~kyrofb-copy__user-return-value-checks-added-to-kyro-fb Wed Feb 9 14:05:10 2005 +++ 25-akpm/drivers/video/kyro/fbdev.c Wed Feb 9 14:05:10 2005 @@ -1,5 +1,5 @@ /* - * linux/drivers/video/kyro/kyrofb.c + * linux/drivers/video/kyro/fbdev.c * * Copyright (C) 2002 STMicroelectronics * Copyright (C) 2003, 2004 Paul Mundt @@ -594,7 +594,8 @@ static int kyrofb_ioctl(struct inode *in switch (cmd) { case KYRO_IOCTL_OVERLAY_CREATE: - copy_from_user(&ol_create, argp, sizeof(overlay_create)); + if (copy_from_user(&ol_create, argp, sizeof(overlay_create))) + return -EFAULT; if (kyro_dev_overlay_create(ol_create.ulWidth, ol_create.ulHeight, 0) < 0) { @@ -604,8 +605,9 @@ static int kyrofb_ioctl(struct inode *in } break; case KYRO_IOCTL_OVERLAY_VIEWPORT_SET: - copy_from_user(&ol_viewport_set, argp, - sizeof(overlay_viewport_set)); + if (copy_from_user(&ol_viewport_set, argp, + sizeof(overlay_viewport_set))) + return -EFAULT; if (kyro_dev_overlay_viewport_set(ol_viewport_set.xOrgin, ol_viewport_set.yOrgin, @@ -625,13 +627,16 @@ static int kyrofb_ioctl(struct inode *in } break; case KYRO_IOCTL_UVSTRIDE: - copy_to_user(argp, &deviceInfo.ulOverlayUVStride, sizeof(unsigned long)); + if (copy_to_user(argp, &deviceInfo.ulOverlayUVStride, sizeof(unsigned long))) + return -EFAULT; break; case KYRO_IOCTL_STRIDE: - copy_to_user(argp, &deviceInfo.ulOverlayStride, sizeof(unsigned long)); + if (copy_to_user(argp, &deviceInfo.ulOverlayStride, sizeof(unsigned long))) + return -EFAULT; break; case KYRO_IOCTL_OVERLAY_OFFSET: - copy_to_user(argp, &deviceInfo.ulOverlayOffset, sizeof(unsigned long)); + if (copy_to_user(argp, &deviceInfo.ulOverlayOffset, sizeof(unsigned long))) + return -EFAULT; break; } _