[PATCH] fb_ioctl() usercopy fix

From: Andrea Arcangeli <andrea@suse.de>

Arrange for ioctl(FBIOPUTCMAP) to do copy_to_user() rather than memcpy.

diff --git a/drivers/video/fbmem.c b/drivers/video/fbmem.c
index 5e28466497693037ed8a077dc3561b49fcf0e2e9..43ccc04c828c94554d3da1307787cbee9bc542b2 100644 (file)
--- a/drivers/video/fbmem.c
+++ b/drivers/video/fbmem.c
@@ -1037,7 +1037,7 @@ fb_ioctl(struct inode *inode, struct file *file, unsigned int cmd,
        case FBIOPUTCMAP:
                if (copy_from_user(&cmap, (void *) arg, sizeof(cmap)))
                        return -EFAULT;
-               return (fb_set_cmap(&cmap, 0, info));
+               return (fb_set_cmap(&cmap, 1, info));
        case FBIOGETCMAP:
                if (copy_from_user(&cmap, (void *) arg, sizeof(cmap)))
                        return -EFAULT;