Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 7c77e4ba authored by AnilKumar Chimata's avatar AnilKumar Chimata Committed by Gerrit - the friendly Code Review server
Browse files

msm: mink: Fix copy_to_user issue 



Fix buffer copy issue encountered during arguments copy
from user space to kernel and vice versa. This also fixes
compilation errors which were triggered after enabling
smcinvoke driver for targets which has 32bit architecture.

Change-Id: I5ecd7d7b91cd42fdbed62c9c8fbf6bba11a9d76c
Signed-off-by: default avatarAnilKumar Chimata <anilc@codeaurora.org>
parent da2a0248

drivers/soc/qcom/smcinvoke.c

+5 −5
Original line number Diff line number Diff line
@@ -1553,7 +1553,7 @@ static long process_accept_req(struct file *filp, unsigned int cmd, 
		return -EINVAL;

	}



	if (copy_from_user(&user_args, (void __user *)arg,

	if (copy_from_user(&user_args, (void __user *)(uintptr_t)arg,

					sizeof(struct smcinvoke_accept))) {

		pr_err("copying accept request from user failed\n");

		return -EFAULT;
@@ -1669,8 +1669,8 @@ static long process_accept_req(struct file *filp, unsigned int cmd, 
							cb_txn->txn_id);

			kref_put(&cb_txn->ref_cnt, delete_cb_txn);

			mutex_unlock(&g_smcinvoke_lock);

			ret =  copy_to_user((void __user *)arg, &user_args,

					sizeof(struct smcinvoke_accept));

			ret =  copy_to_user((void __user *)(uintptr_t)arg,

				&user_args, sizeof(struct smcinvoke_accept));

		}

	} while (!cb_txn);

out:
@@ -1715,7 +1715,7 @@ static long process_invoke_req(struct file *filp, unsigned int cmd, 
		return -EPERM;

	}



	ret = copy_from_user(&req, (void __user *)arg, sizeof(req));

	ret = copy_from_user(&req, (void __user *)(uintptr_t)arg, sizeof(req));

	if (ret) {

		pr_err("copying invoke req failed\n");

		return -EFAULT;
@@ -1799,7 +1799,7 @@ static long process_invoke_req(struct file *filp, unsigned int cmd, 
					nr_args * req.argsize);

	}

	/* copy result of invoke op */

	ret |=  copy_to_user((void __user *)arg, &req, sizeof(req));

	ret |=  copy_to_user((void __user *)(uintptr_t)arg, &req, sizeof(req));

	if (ret)

		goto out;