For the COMEDI_DEVCONFIG ioctl, the user application may embed a pointer
to firmware data within a designated element (or two elements for 64-bit
pointers) of the `options[]` array in the `struct comedi_devconfig`.
`do_devconfig_ioctl()` calls `comedi_aux_data()` to extract the pointer
value. It needs to be treated as a `__user` pointer so the firmware
data can be copied into kernel memory, so cast the result of
`comedi_aux_data()` to avoid a "sparse" warning. This is not ideal but
`comedi_aux_data()` is called elsewhere in a wholly kernel memory
context so we can't just change its return type to include the `__user`
tag.
Signed-off-by: Ian Abbott <abbotti@xxxxxxxxx>
---
drivers/staging/comedi/comedi_fops.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/staging/comedi/comedi_fops.c b/drivers/staging/comedi/comedi_fops.c
index 7d18325..55722b3 100644
--- a/drivers/staging/comedi/comedi_fops.c
+++ b/drivers/staging/comedi/comedi_fops.c
@@ -370,7 +370,8 @@ static int do_devconfig_ioctl(struct comedi_device *dev,
return -ENOMEM;
if (copy_from_user(aux_data,
- comedi_aux_data(it.options, 0), aux_len)) {
+ (unsigned char __user *
+ )comedi_aux_data(it.options, 0), aux_len)) {
vfree(aux_data);
return -EFAULT;
}
--
1.7.12
_______________________________________________
devel mailing list
devel@xxxxxxxxxxxxxxxxxxxxxx
http://driverdev.linuxdriverproject.org/mailman/listinfo/devel
