Commit 96ae3276 authored by Phil Elwell's avatar Phil Elwell Committed by Greg Kroah-Hartman

staging: vchiq: Fix bulk userdata handling

The addition of the local 'userdata' pointer to
vchiq_irq_queue_bulk_tx_rx omitted the case where neither BLOCKING nor
WAITING modes are used, in which case the value provided by the
caller is not returned to them as expected, but instead it is replaced
with a NULL. This lack of a suitable context may cause the application
to crash or otherwise malfunction.

Fixes: 4184da4f ("staging: vchiq: fix __user annotations")
Tested-by: default avatarStefan Wahren <stefan.wahren@i2se.com>
Acked-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: default avatarPhil Elwell <phil@raspberrypi.com>
Link: https://lore.kernel.org/r/20210105162030.1415213-2-phil@raspberrypi.comSigned-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 87bb53b7
...@@ -958,7 +958,7 @@ static int vchiq_irq_queue_bulk_tx_rx(struct vchiq_instance *instance, ...@@ -958,7 +958,7 @@ static int vchiq_irq_queue_bulk_tx_rx(struct vchiq_instance *instance,
struct vchiq_service *service; struct vchiq_service *service;
struct bulk_waiter_node *waiter = NULL; struct bulk_waiter_node *waiter = NULL;
bool found = false; bool found = false;
void *userdata = NULL; void *userdata;
int status = 0; int status = 0;
int ret; int ret;
...@@ -997,6 +997,8 @@ static int vchiq_irq_queue_bulk_tx_rx(struct vchiq_instance *instance, ...@@ -997,6 +997,8 @@ static int vchiq_irq_queue_bulk_tx_rx(struct vchiq_instance *instance,
"found bulk_waiter %pK for pid %d", waiter, "found bulk_waiter %pK for pid %d", waiter,
current->pid); current->pid);
userdata = &waiter->bulk_waiter; userdata = &waiter->bulk_waiter;
} else {
userdata = args->userdata;
} }
status = vchiq_bulk_transfer(args->handle, NULL, args->data, args->size, status = vchiq_bulk_transfer(args->handle, NULL, args->data, args->size,
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment