Nice write-up, especially the fix analysis at the end.
How did you find the bug to begin with?
I’m sorry for the late response. I only noticed your comment now.
Not much of a war lore. I simply searched for problematic copy_from_user() cases :)
entirely non-sarcastic: on the bright side, as an android developer, the total number of Nexus 9s I have seen in my usage stats is effectively zero.