Hi Julia, Andrew,
Julia Lawall schrieb:
From: Julia Lawall <julia@xxxxxxx>
sizeof(viafb_gamma_table) is just the size of the pointer. This is changed
to the size used when calling kmalloc to initialize the pointer.
this is the second patch addressing this issue ending up in my mailbox.
At least this one is technically correct so feel free to upstream it.
However I vote for removing this ioctl hell from viafb as most of them
duplicate framebuffer functionality or have unknown (not clearly
defined) functionality or at least solve a generic problem with a custom
ioctl (which I consider bad). I had a patch ready to move this stuff to
an extra file and print a warning that it is subject to be removed. I
feel a bit uncomfortable about repairing broken stuff prior to removing it.
Any comments on this subject?
Thanks,
Florian Tobias Schandinat
Signed-off-by: Julia Lawall <julia@xxxxxxx>
---
drivers/video/via/viafbdev.c | 4 ++--
1 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/video/via/viafbdev.c b/drivers/video/via/viafbdev.c
index 56ec696..a0b47f1 100644
--- a/drivers/video/via/viafbdev.c
+++ b/drivers/video/via/viafbdev.c
@@ -680,7 +680,7 @@ static int viafb_ioctl(struct fb_info *info, u_int cmd, u_long arg)
if (!viafb_gamma_table)
return -ENOMEM;
if (copy_from_user(viafb_gamma_table, argp,
- sizeof(viafb_gamma_table))) {
+ 256 * sizeof(u32))) {
kfree(viafb_gamma_table);
return -EFAULT;
}
@@ -694,7 +694,7 @@ static int viafb_ioctl(struct fb_info *info, u_int cmd, u_long arg)
return -ENOMEM;
viafb_get_gamma_table(viafb_gamma_table);
if (copy_to_user(argp, viafb_gamma_table,
- sizeof(viafb_gamma_table))) {
+ 256 * sizeof(u32))) {
kfree(viafb_gamma_table);
return -EFAULT;
}
--
To unsubscribe from this list: send the line "unsubscribe kernel-janitors" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
