All of lore.kernel.org
 help / color / mirror / Atom feed
From: Phi Nguyen <phind.uet@gmail.com>
To: Al Viro <viro@zeniv.linux.org.uk>
Cc: nsaenz@kernel.org, gregkh@linuxfoundation.org,
	stefan.wahren@i2se.com, arnd@arndb.de, dan.carpenter@oracle.com,
	phil@raspberrypi.com, amarjargal16@gmail.com,
	bcm-kernel-feedback-list@broadcom.com,
	linux-rpi-kernel@lists.infradead.org,
	linux-arm-kernel@lists.infradead.org,
	linux-staging@lists.linux.dev, linux-kernel@vger.kernel.org
Subject: Re: [PATCH] staging: vchiq_arm: Using copy_from_user() to copy data from userspace address
Date: Tue, 25 May 2021 01:26:23 +0800	[thread overview]
Message-ID: <51eaace6-e464-147f-85be-ec8188e0e2ef@gmail.com> (raw)
In-Reply-To: <YKilx7iNSBYYbXSs@zeniv-ca.linux.org.uk>

On 22/5/21 2:33 pm, Al Viro wrote:
> On Sat, May 22, 2021 at 01:34:29PM +0800, Nguyen Dinh Phi wrote:
>> This commit to fix the following sparse warning:
>> incorrect type in assignment (different address spaces)
>> expected void *[assigned] userdata
>> got void [noderef] __user *userdata
>>
>> Signed-off-by: Nguyen Dinh Phi <phind.uet@gmail.com>
>> ---
>>   .../staging/vc04_services/interface/vchiq_arm/vchiq_arm.c    | 5 ++++-
>>   1 file changed, 4 insertions(+), 1 deletion(-)
>>
>> diff --git a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c
>> index afbf01b7364c..2a4fc599f977 100644
>> --- a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c
>> +++ b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c
>> @@ -960,7 +960,10 @@ static int vchiq_irq_queue_bulk_tx_rx(struct vchiq_instance *instance,
>>   			current->pid);
>>   		userdata = &waiter->bulk_waiter;
>>   	} else {
>> -		userdata = args->userdata;
>> +		if (copy_from_user(userdata, args->userdata, sizeof(args->userdata))) {
> 
> 	The contents of userdata (local variable of type void *) is uninitialized at that
> point.
Sorry, That was my mistake.

> Just what do you think that call of copy_from_user() would do? 

Because according to the definition of struct vchiq_queue_bulk_transfer, 
the args->userdata pointer is userspace address.

WARNING: multiple messages have this Message-ID (diff)
From: Phi Nguyen <phind.uet@gmail.com>
To: Al Viro <viro@zeniv.linux.org.uk>
Cc: nsaenz@kernel.org, gregkh@linuxfoundation.org,
	stefan.wahren@i2se.com, arnd@arndb.de, dan.carpenter@oracle.com,
	phil@raspberrypi.com, amarjargal16@gmail.com,
	bcm-kernel-feedback-list@broadcom.com,
	linux-rpi-kernel@lists.infradead.org,
	linux-arm-kernel@lists.infradead.org,
	linux-staging@lists.linux.dev, linux-kernel@vger.kernel.org
Subject: Re: [PATCH] staging: vchiq_arm: Using copy_from_user() to copy data from userspace address
Date: Tue, 25 May 2021 01:26:23 +0800	[thread overview]
Message-ID: <51eaace6-e464-147f-85be-ec8188e0e2ef@gmail.com> (raw)
In-Reply-To: <YKilx7iNSBYYbXSs@zeniv-ca.linux.org.uk>

On 22/5/21 2:33 pm, Al Viro wrote:
> On Sat, May 22, 2021 at 01:34:29PM +0800, Nguyen Dinh Phi wrote:
>> This commit to fix the following sparse warning:
>> incorrect type in assignment (different address spaces)
>> expected void *[assigned] userdata
>> got void [noderef] __user *userdata
>>
>> Signed-off-by: Nguyen Dinh Phi <phind.uet@gmail.com>
>> ---
>>   .../staging/vc04_services/interface/vchiq_arm/vchiq_arm.c    | 5 ++++-
>>   1 file changed, 4 insertions(+), 1 deletion(-)
>>
>> diff --git a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c
>> index afbf01b7364c..2a4fc599f977 100644
>> --- a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c
>> +++ b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c
>> @@ -960,7 +960,10 @@ static int vchiq_irq_queue_bulk_tx_rx(struct vchiq_instance *instance,
>>   			current->pid);
>>   		userdata = &waiter->bulk_waiter;
>>   	} else {
>> -		userdata = args->userdata;
>> +		if (copy_from_user(userdata, args->userdata, sizeof(args->userdata))) {
> 
> 	The contents of userdata (local variable of type void *) is uninitialized at that
> point.
Sorry, That was my mistake.

> Just what do you think that call of copy_from_user() would do? 

Because according to the definition of struct vchiq_queue_bulk_transfer, 
the args->userdata pointer is userspace address.

_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel

  reply	other threads:[~2021-05-24 17:26 UTC|newest]

Thread overview: 8+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-05-22  5:34 [PATCH] staging: vchiq_arm: Using copy_from_user() to copy data from userspace address Nguyen Dinh Phi
2021-05-22  5:34 ` Nguyen Dinh Phi
2021-05-22  6:33 ` Al Viro
2021-05-22  6:33   ` Al Viro
2021-05-24 17:26   ` Phi Nguyen [this message]
2021-05-24 17:26     ` Phi Nguyen
2021-05-25  2:12     ` Al Viro
2021-05-25  2:12       ` Al Viro

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=51eaace6-e464-147f-85be-ec8188e0e2ef@gmail.com \
    --to=phind.uet@gmail.com \
    --cc=amarjargal16@gmail.com \
    --cc=arnd@arndb.de \
    --cc=bcm-kernel-feedback-list@broadcom.com \
    --cc=dan.carpenter@oracle.com \
    --cc=gregkh@linuxfoundation.org \
    --cc=linux-arm-kernel@lists.infradead.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-rpi-kernel@lists.infradead.org \
    --cc=linux-staging@lists.linux.dev \
    --cc=nsaenz@kernel.org \
    --cc=phil@raspberrypi.com \
    --cc=stefan.wahren@i2se.com \
    --cc=viro@zeniv.linux.org.uk \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.