lkml.org 
[lkml]   [2021]   [Mar]   [1]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.10 037/663] staging: vchiq: Fix bulk userdata handling
    Date
    From: Phil Elwell <phil@raspberrypi.com>

    [ Upstream commit 96ae327678eceabf455b11a88ba14ad540d4b046 ]

    The addition of the local 'userdata' pointer to
    vchiq_irq_queue_bulk_tx_rx omitted the case where neither BLOCKING nor
    WAITING modes are used, in which case the value provided by the
    caller is not returned to them as expected, but instead it is replaced
    with a NULL. This lack of a suitable context may cause the application
    to crash or otherwise malfunction.

    Fixes: 4184da4f316a ("staging: vchiq: fix __user annotations")
    Tested-by: Stefan Wahren <stefan.wahren@i2se.com>
    Acked-by: Dan Carpenter <dan.carpenter@oracle.com>
    Signed-off-by: Phil Elwell <phil@raspberrypi.com>
    Link: https://lore.kernel.org/r/20210105162030.1415213-2-phil@raspberrypi.com
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c | 4 +++-
    1 file changed, 3 insertions(+), 1 deletion(-)

    diff --git a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c
    index 01125d9f991bb..5bc9b394212b8 100644
    --- a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c
    +++ b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_arm.c
    @@ -953,7 +953,7 @@ static int vchiq_irq_queue_bulk_tx_rx(struct vchiq_instance *instance,
    struct vchiq_service *service;
    struct bulk_waiter_node *waiter = NULL;
    bool found = false;
    - void *userdata = NULL;
    + void *userdata;
    int status = 0;
    int ret;

    @@ -992,6 +992,8 @@ static int vchiq_irq_queue_bulk_tx_rx(struct vchiq_instance *instance,
    "found bulk_waiter %pK for pid %d", waiter,
    current->pid);
    userdata = &waiter->bulk_waiter;
    + } else {
    + userdata = args->userdata;
    }

    /*
    --
    2.27.0


    \
     
     \ /
      Last update: 2021-03-02 04:40    [W:4.047 / U:0.176 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site