Re: [linux-usb-devel] Re: Finding user/kernel pointer bugs [no html]

2004-06-11 Thread Luca Risolia
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 On Fri, 11 Jun 2004 09:17:48 -0700 Greg KH <[EMAIL PROTECTED]> wrote: > On Fri, Jun 11, 2004 at 06:31:07AM +0200, Luca Risolia wrote: > > >unsigned int cmd, void* arg) > > > { > > > struct w9968cf_device* cam; > > > + void __use

Re: [linux-usb-devel] Re: Finding user/kernel pointer bugs [no html]

2004-06-11 Thread Greg KH
On Fri, Jun 11, 2004 at 06:31:07AM +0200, Luca Risolia wrote: > >unsigned int cmd, void* arg) > > { > > struct w9968cf_device* cam; > > + void __user *user_arg = (void __user *)arg; > > The right place to apply this patch is in video_usercopy(). Um, the driver you just

Re: [linux-usb-devel] Re: Finding user/kernel pointer bugs [no html]

2004-06-10 Thread viro
On Fri, Jun 11, 2004 at 06:31:07AM +0200, Luca Risolia wrote: > -BEGIN PGP SIGNED MESSAGE- > Hash: SHA1 > > >unsigned int cmd, void* arg) > > { > > struct w9968cf_device* cam; > > + void __user *user_arg = (void __user *)arg; > > The right place to apply this pa

[linux-usb-devel] Re: Finding user/kernel pointer bugs [no html]

2004-06-10 Thread Luca Risolia
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 >unsigned int cmd, void* arg) > { > struct w9968cf_device* cam; > + void __user *user_arg = (void __user *)arg; The right place to apply this patch is in video_usercopy(). When video_usercopy() is used in the ioctl() me

[linux-usb-devel] Re: Finding user/kernel pointer bugs [no html]

2004-06-10 Thread Greg KH
On Thu, Jun 10, 2004 at 07:45:20PM +0100, [EMAIL PROTECTED] wrote: > On Thu, Jun 10, 2004 at 11:34:42AM -0700, Greg KH wrote: > > struct usb_mixerdev *ms = (struct usb_mixerdev *)file->private_data; > > int i, j, val; > > + int __user *int_user_arg = (int __user *)arg; > > Egads... How

[linux-usb-devel] Re: Finding user/kernel pointer bugs [no html]

2004-06-10 Thread viro
On Thu, Jun 10, 2004 at 11:34:42AM -0700, Greg KH wrote: > struct usb_mixerdev *ms = (struct usb_mixerdev *)file->private_data; > int i, j, val; > + int __user *int_user_arg = (int __user *)arg; Egads... How about changing the name to something that would not be so scary? --

[linux-usb-devel] Re: Finding user/kernel pointer bugs [no html]

2004-06-10 Thread Greg KH
On Thu, Jun 10, 2004 at 09:58:21AM -0700, Greg KH wrote: > On Thu, Jun 10, 2004 at 05:49:03AM +0100, [EMAIL PROTECTED] wrote: > > > bugs in drivers/usb/core/devio.c:proc_control() even though that > > > function has been annotated (this is not the first time cqual has found > > > bugs in code audit