From: Andrew Morton <akpm@linux-foundation.org>
Date: Thu, 16 Oct 2008 05:04:18 +0000 (-0700)
Subject: applicom.c: fix apparently-broken code in do_ac_read()
X-Git-Tag: v2.6.28-rc1~351
X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=bc20589bf1c63e4e8bee57855568458ba303306b;p=platform%2Fkernel%2Flinux-stable.git

applicom.c: fix apparently-broken code in do_ac_read()

The code scriblles over a local pointer whereas it appears to be trying
to write to the memory at which that pointer points.

Addresses http://bugzilla.kernel.org/show_bug.cgi?id=11397

Nobody we know can test this change.

Reported-by: Zvonimir Rakamaric <zrakamar@cs.ubc.ca>
Cc: Jesse Barnes <jbarnes@virtuousgeek.org>
Cc: David Woodhouse <dwmw2@infradead.org>
Cc: Jiri Slaby <jirislaby@gmail.com>
Cc: Alan Cox <alan@lxorguk.ukuu.org.uk>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
---

diff --git a/drivers/char/applicom.c b/drivers/char/applicom.c
index b899d9182c7d..05674febb0c6 100644
--- a/drivers/char/applicom.c
+++ b/drivers/char/applicom.c
@@ -478,7 +478,7 @@ static int do_ac_read(int IndexCard, char __user *buf,
 		struct st_ram_io *st_loc, struct mailbox *mailbox)
 {
 	void __iomem *from = apbs[IndexCard].RamIO + RAM_TO_PC;
-	unsigned char *to = (unsigned char *)&mailbox;
+	unsigned char *to = (unsigned char *)mailbox;
 #ifdef DEBUG
 	int c;
 #endif