Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit e099c793 authored by mohamed sunfeer's avatar mohamed sunfeer Committed by Shivaprasad Hongal
Browse files

compat_qcedev: Fix accessing userspace memory in kernel space 



Use put_user API to write the data to userspace from kernel
space to avoid accessing userspace memory directly in
kernel space.

Change-Id: I4dd73872ab8c374793268cef2b9a2dfccf3454c9
Signed-off-by: default avatarmohamed sunfeer <msunfeer@codeaurora.org>
Signed-off-by: default avatarShivaprasad Hongal <shongal@codeaurora.org>
parent 1996ec83

drivers/crypto/msm/compat_qcedev.c

+0 −8
Original line number Diff line number Diff line
@@ -96,7 +96,6 @@ static int compat_get_qcedev_vbuf_info( 


	for (i = 0; i < QCEDEV_MAX_BUFFERS; i++) {

		err |= get_user(vaddr, &vbuf32->src[i].vaddr);

		vbuf->src[i].vaddr = NULL;

		err |= put_user(vaddr, (compat_uptr_t *)&vbuf->src[i].vaddr);

		err |= get_user(len, &vbuf32->src[i].len);

		err |= put_user(len, &vbuf->src[i].len);
@@ -104,7 +103,6 @@ static int compat_get_qcedev_vbuf_info( 


	for (i = 0; i < QCEDEV_MAX_BUFFERS; i++) {

		err |= get_user(vaddr, &vbuf32->dst[i].vaddr);

		vbuf->dst[i].vaddr = NULL;

		err |= put_user(vaddr, (compat_uptr_t *)&vbuf->dst[i].vaddr);

		err |= get_user(len, &vbuf32->dst[i].len);

		err |= put_user(len, &vbuf->dst[i].len);
@@ -122,7 +120,6 @@ static int compat_put_qcedev_vbuf_info( 


	for (i = 0; i < QCEDEV_MAX_BUFFERS; i++) {

		err |= get_user(vaddr, (compat_uptr_t *)&vbuf->src[i].vaddr);

		vbuf32->src[i].vaddr = 0;

		err |= put_user(vaddr, &vbuf32->src[i].vaddr);

		err |= get_user(len, &vbuf->src[i].len);

		err |= put_user(len, &vbuf32->src[i].len);
@@ -130,7 +127,6 @@ static int compat_put_qcedev_vbuf_info( 


	for (i = 0; i < QCEDEV_MAX_BUFFERS; i++) {

		err |= get_user(vaddr, (compat_uptr_t *)&vbuf->dst[i].vaddr);

		vbuf32->dst[i].vaddr = 0;

		err |= put_user(vaddr, &vbuf32->dst[i].vaddr);

		err |= get_user(len, &vbuf->dst[i].len);

		err |= put_user(len, &vbuf32->dst[i].len);
@@ -275,7 +271,6 @@ static int compat_get_qcedev_sha_op_req( 


	for (i = 0; i < QCEDEV_MAX_BUFFERS; i++) {

		err |= get_user(vaddr, &data32->data[i].vaddr);

		data->data[i].vaddr = 0;

		err |= put_user(vaddr, (compat_uptr_t *)&data->data[i].vaddr);

		err |= get_user(len, &data32->data[i].len);

		err |= put_user(len, &data->data[i].len);
@@ -294,7 +289,6 @@ static int compat_get_qcedev_sha_op_req( 
	err |= get_user(diglen, &data32->diglen);

	err |= put_user(diglen, &data->diglen);

	err |= get_user(authkey, &data32->authkey);

	data->authkey = NULL;

	err |= put_user(authkey, (compat_uptr_t *)&data->authkey);

	err |= get_user(authklen, &data32->authklen);

	err |= put_user(authklen, &data->authklen);
@@ -321,7 +315,6 @@ static int compat_put_qcedev_sha_op_req( 


	for (i = 0; i < QCEDEV_MAX_BUFFERS; i++) {

		err |= get_user(vaddr, (compat_uptr_t *)&data->data[i].vaddr);

		data32->data[i].vaddr = 0;

		err |= put_user(vaddr, &data32->data[i].vaddr);

		err |= get_user(len, &data->data[i].len);

		err |= put_user(len, &data32->data[i].len);
@@ -340,7 +333,6 @@ static int compat_put_qcedev_sha_op_req( 
	err |= get_user(diglen, &data->diglen);

	err |= put_user(diglen, &data32->diglen);

	err |= get_user(authkey, (compat_uptr_t *)&data->authkey);

	data32->authkey = 0;

	err |= put_user(authkey, &data32->authkey);

	err |= get_user(authklen, &data->authklen);

	err |= put_user(authklen, &data32->authklen);