From 0e32637090f1dffd9f0f7338a4c4c08738a03005 Mon Sep 17 00:00:00 2001
From: Augustin Cavalier <waddlesplash@gmail.com>
Date: Sat, 12 Jul 2025 16:46:05 -0400
Subject: [PATCH] poke: Add missing IS_USER_ADDRESS checks.

---
 src/add-ons/kernel/drivers/misc/poke.cpp | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/src/add-ons/kernel/drivers/misc/poke.cpp b/src/add-ons/kernel/drivers/misc/poke.cpp
index a71e19f35c..a3757d8d18 100644
--- a/src/add-ons/kernel/drivers/misc/poke.cpp
+++ b/src/add-ons/kernel/drivers/misc/poke.cpp
@@ -140,6 +140,9 @@ poke_free(void* cookie)
 status_t
 poke_control(void* cookie, uint32 op, void* arg, size_t length)
 {
+	if (!IS_USER_ADDRESS(arg))
+		return B_BAD_ADDRESS;
+
 	switch (op) {
 		case POKE_PORT_READ:
 		{
@@ -259,6 +262,8 @@ poke_control(void* cookie, uint32 op, void* arg, size_t length)
 				return B_BAD_ADDRESS;
 			if (ioctl.signature != POKE_SIGNATURE)
 				return B_BAD_VALUE;
+			if (!IS_USER_ADDRESS(ioctl.info))
+				return B_BAD_ADDRESS;
 
 			pci_info info;
 			ioctl.status = pci->get_nth_pci_info(ioctl.index, &info);