This patch fixes sparse warnings about the memcmp function unsafely accessing userspace memory without first copying it to kernel space. Signed-off-by: Charlie Sands <sandsch@xxxxxxxxxxxxxxxxxxxxx> --- drivers/staging/r8188eu/os_dep/ioctl_linux.c | 20 ++++++++++++-------- 1 file changed, 12 insertions(+), 8 deletions(-) diff --git a/drivers/staging/r8188eu/os_dep/ioctl_linux.c b/drivers/staging/r8188eu/os_dep/ioctl_linux.c index 7df213856d66..1cfac1b27eb7 100644 --- a/drivers/staging/r8188eu/os_dep/ioctl_linux.c +++ b/drivers/staging/r8188eu/os_dep/ioctl_linux.c @@ -3233,23 +3233,27 @@ static int rtw_p2p_get(struct net_device *dev, struct iw_request_info *info, union iwreq_data *wrqu, char *extra) { - if (!memcmp(wrqu->data.pointer, "status", 6)) { + char wrqu_data_ptr[9]; + if (copy_from_user(wrqu_data_ptr, wrqu->data.pointer, 9)) + return 0; + + if (!memcmp(wrqu_data_ptr, "status", 6)) { rtw_p2p_get_status(dev, info, wrqu, extra); - } else if (!memcmp(wrqu->data.pointer, "role", 4)) { + } else if (!memcmp(wrqu_data_ptr, "role", 4)) { rtw_p2p_get_role(dev, info, wrqu, extra); - } else if (!memcmp(wrqu->data.pointer, "peer_ifa", 8)) { + } else if (!memcmp(wrqu_data_ptr, "peer_ifa", 8)) { rtw_p2p_get_peer_ifaddr(dev, info, wrqu, extra); - } else if (!memcmp(wrqu->data.pointer, "req_cm", 6)) { + } else if (!memcmp(wrqu_data_ptr, "req_cm", 6)) { rtw_p2p_get_req_cm(dev, info, wrqu, extra); - } else if (!memcmp(wrqu->data.pointer, "peer_deva", 9)) { + } else if (!memcmp(wrqu_data_ptr, "peer_deva", 9)) { /* Get the P2P device address when receiving the provision discovery request frame. */ rtw_p2p_get_peer_devaddr(dev, info, wrqu, extra); - } else if (!memcmp(wrqu->data.pointer, "group_id", 8)) { + } else if (!memcmp(wrqu_data_ptr, "group_id", 8)) { rtw_p2p_get_groupid(dev, info, wrqu, extra); - } else if (!memcmp(wrqu->data.pointer, "peer_deva_inv", 9)) { + } else if (!memcmp(wrqu_data_ptr, "peer_deva_inv", 9)) { /* Get the P2P device address when receiving the P2P Invitation request frame. */ rtw_p2p_get_peer_devaddr_by_invitation(dev, info, wrqu, extra); - } else if (!memcmp(wrqu->data.pointer, "op_ch", 5)) { + } else if (!memcmp(wrqu_data_ptr, "op_ch", 5)) { rtw_p2p_get_op_ch(dev, info, wrqu, extra); } return 0; -- 2.35.1