diff options
| author | Linux Build Service Account <lnxbuild@localhost> | 2020-09-25 10:05:31 -0700 |
|---|---|---|
| committer | Gerrit - the friendly Code Review server <code-review@localhost> | 2020-09-25 10:05:30 -0700 |
| commit | c5aa7012a304bb2b0067c4ebbbca6c1107cd8ab9 (patch) | |
| tree | 83fdd977d2e5aae2f64b7c6791ae6122b60f86cf | |
| parent | 999e55b1c1586858cc16a8157ec0a31df36785d1 (diff) | |
| parent | 74079d53edfd706052233935486ce92481214d17 (diff) | |
Merge "msm: mink: Fix copy_to_user issue"LA.UM.9.12.r1-08300-SMxx50.0
| -rw-r--r-- | drivers/soc/qcom/smcinvoke.c | 10 |
1 files changed, 5 insertions, 5 deletions
diff --git a/drivers/soc/qcom/smcinvoke.c b/drivers/soc/qcom/smcinvoke.c index 24c93555c3e8..07eaffd361eb 100644 --- a/drivers/soc/qcom/smcinvoke.c +++ b/drivers/soc/qcom/smcinvoke.c @@ -1553,7 +1553,7 @@ static long process_accept_req(struct file *filp, unsigned int cmd, return -EINVAL; } - if (copy_from_user(&user_args, (void __user *)arg, + if (copy_from_user(&user_args, (void __user *)(uintptr_t)arg, sizeof(struct smcinvoke_accept))) { pr_err("copying accept request from user failed\n"); return -EFAULT; @@ -1669,8 +1669,8 @@ static long process_accept_req(struct file *filp, unsigned int cmd, cb_txn->txn_id); kref_put(&cb_txn->ref_cnt, delete_cb_txn); mutex_unlock(&g_smcinvoke_lock); - ret = copy_to_user((void __user *)arg, &user_args, - sizeof(struct smcinvoke_accept)); + ret = copy_to_user((void __user *)(uintptr_t)arg, + &user_args, sizeof(struct smcinvoke_accept)); } } while (!cb_txn); out: @@ -1715,7 +1715,7 @@ static long process_invoke_req(struct file *filp, unsigned int cmd, return -EPERM; } - ret = copy_from_user(&req, (void __user *)arg, sizeof(req)); + ret = copy_from_user(&req, (void __user *)(uintptr_t)arg, sizeof(req)); if (ret) { pr_err("copying invoke req failed\n"); return -EFAULT; @@ -1799,7 +1799,7 @@ static long process_invoke_req(struct file *filp, unsigned int cmd, nr_args * req.argsize); } /* copy result of invoke op */ - ret |= copy_to_user((void __user *)arg, &req, sizeof(req)); + ret |= copy_to_user((void __user *)(uintptr_t)arg, &req, sizeof(req)); if (ret) goto out; |