On 03/22/2011 09:58 AM, Peter Huewe wrote: > >> Consider what happens in memset if copy_to_user fails. > Sorry I don't see it. Can you please clearify the problem for me? > memset() is called with the count parameter being a negative value, ret_size=-EFAULT.