From: Andrea Arcangeli Arrange for ioctl(FBIOPUTCMAP) to do copy_to_user() rather than memcpy. --- 25-akpm/drivers/video/fbmem.c | 2 +- 1 files changed, 1 insertion(+), 1 deletion(-) diff -puN drivers/video/fbmem.c~fb_ioctl-usercopy-fix drivers/video/fbmem.c --- 25/drivers/video/fbmem.c~fb_ioctl-usercopy-fix 2004-04-20 19:20:59.341672688 -0700 +++ 25-akpm/drivers/video/fbmem.c 2004-04-20 19:20:59.345672080 -0700 @@ -1037,7 +1037,7 @@ fb_ioctl(struct inode *inode, struct fil case FBIOPUTCMAP: if (copy_from_user(&cmap, (void *) arg, sizeof(cmap))) return -EFAULT; - return (fb_set_cmap(&cmap, 0, info)); + return (fb_set_cmap(&cmap, 1, info)); case FBIOGETCMAP: if (copy_from_user(&cmap, (void *) arg, sizeof(cmap))) return -EFAULT; _