matthew green wrote:

> this seems bogus.  what "plenty of those" are you referencing?  i'm
> not aware of any off hand and while restricted to root helps a bunch
> we should fail these requests instead of panicing.  they are bugs to
> be fixed.
> 
> i'm curious why the kernel would be dereferencing an kernel address
> that userland supplied, instead of a userland address... when does
> userland know kernel addresses like this?  besides LKMs.

you are 100% right, that whole code is bogus. it should use copyin()
instead of memcpy().

-e.

-- 
Elad Efrat