Bug/exploit in ide_taskfile_ioctl() ??

[Mark Lord <liml@rtr.ca>]

Hi,

I just noticed this code (below) in ide-taskfile.c.
In particular, the two lines that initialize argsptr and hobsptr
appear to be completely incorrect, and if this function is ever
invoked they stand a good chance of causing memory corruption

int ide_taskfile_ioctl (ide_drive_t *drive, unsigned int cmd, unsigned long arg)
{
         ide_task_request_t      *req_task;
         ide_task_t              args;
         u8 *outbuf              = NULL;
         u8 *inbuf               = NULL;
         task_ioreg_t *argsptr   = args.tfRegister;
         task_ioreg_t *hobsptr   = args.hobRegister;
         int err                 = 0;
   ...
         memcpy(argsptr, req_task->io_ports, HDIO_DRIVE_TASK_HDR_SIZE);
         memcpy(hobsptr, req_task->hob_ports, HDIO_DRIVE_HOB_HDR_SIZE);
   ...


I belive there's a missing '&' on both of the initialization lines.

Cheers