From: Hollis Blanchard <hollisb@us.ibm.com>

Like radio-cadet.c, bw-qcam.c is calling copy_to_user() where it shouldn't. 
The user buffer is copied to/from kernel space by
drivers/media/video/videodev.c:video_usercopy().



 25-akpm/drivers/media/video/bw-qcam.c |    2 --
 1 files changed, 2 deletions(-)

diff -puN drivers/media/video/bw-qcam.c~bw-qcam-fix drivers/media/video/bw-qcam.c
--- 25/drivers/media/video/bw-qcam.c~bw-qcam-fix	Tue Jun  3 11:44:59 2003
+++ 25-akpm/drivers/media/video/bw-qcam.c	Tue Jun  3 11:44:59 2003
@@ -723,8 +723,6 @@ static int qcam_do_ioctl(struct inode *i
 			/* Good question.. its composite or SVHS so.. */
 			v->type = VIDEO_TYPE_CAMERA;
 			strcpy(v->name, "Camera");
-			if(copy_to_user(arg, &v, sizeof(v)))
-				return -EFAULT;
 			return 0;
 		}
 		case VIDIOCSCHAN:

_