From 428d8bc6fcdc949dc538d29e32255402072f10a5 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=A9r=C3=B4me=20Duval?= <jerome.duval@gmail.com>
Date: Fri, 13 Sep 2019 18:51:56 +0200
Subject: [PATCH] usb_hid: use user_memcpy in
 JoystickProtocolHandler::Control().
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

on success, returns B_OK instead of B_ERROR.

Change-Id: I3e415d812ddbc6dbc4d27f346bbe7ea59374b39f
Reviewed-on: https://review.haiku-os.org/c/haiku/+/1861
Reviewed-by: Stephan Aßmus <superstippi@gmx.de>
---
 .../input/usb_hid/JoystickProtocolHandler.cpp  | 18 ++++++++++++++----
 1 file changed, 14 insertions(+), 4 deletions(-)

diff --git a/src/add-ons/kernel/drivers/input/usb_hid/JoystickProtocolHandler.cpp b/src/add-ons/kernel/drivers/input/usb_hid/JoystickProtocolHandler.cpp
index 6900951c20..0dbcb3ce94 100644
--- a/src/add-ons/kernel/drivers/input/usb_hid/JoystickProtocolHandler.cpp
+++ b/src/add-ons/kernel/drivers/input/usb_hid/JoystickProtocolHandler.cpp
@@ -19,6 +19,8 @@
 #include <string.h>
 #include <usb/USB_hid.h>
 
+#include <kernel.h>
+
 
 JoystickProtocolHandler::JoystickProtocolHandler(HIDReport &report)
 	:
@@ -271,7 +273,11 @@ JoystickProtocolHandler::Control(uint32 *cookie, uint32 op, void *buffer,
 			if (result != B_OK)
 				return result;
 
-			fJoystickModuleInfo = *(joystick_module_info *)buffer;
+			if (!IS_USER_ADDRESS(buffer)
+				|| user_memcpy(&fJoystickModuleInfo, buffer,
+					sizeof(joystick_module_info)) != B_OK) {
+				return B_BAD_ADDRESS;
+			}
 
 			bool supportsVariable = (fJoystickModuleInfo.flags
 				& js_flag_variable_size_reads) != 0;
@@ -298,15 +304,19 @@ JoystickProtocolHandler::Control(uint32 *cookie, uint32 op, void *buffer,
 			fJoystickModuleInfo.num_sticks = 1;
 			fJoystickModuleInfo.config_size = 0;
 			mutex_unlock(&fUpdateLock);
-			break;
+			return B_OK;
 		}
 
 		case B_JOYSTICK_GET_DEVICE_MODULE:
 			if (length < sizeof(joystick_module_info))
 				return B_BAD_VALUE;
 
-			*(joystick_module_info *)buffer = fJoystickModuleInfo;
-			break;
+			if (!IS_USER_ADDRESS(buffer)
+				|| user_memcpy(buffer, &fJoystickModuleInfo,
+					sizeof(joystick_module_info)) != B_OK) {
+				return B_BAD_ADDRESS;
+			}
+			return B_OK;
 	}
 
 	return B_ERROR;