From 471e44c9623d3724a6afaeac38cba45b3e190839 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?J=C3=A9r=C3=B4me=20Duval?= Date: Fri, 26 Apr 2019 17:29:12 +0200 Subject: [PATCH] mem: use user_memcpy instead of memcpy. Change-Id: Id37e0e48a936de2e9fcfc5b9e16aad22b6dd0901 Reviewed-on: https://review.haiku-os.org/c/1414 Reviewed-by: Adrien Destugues --- src/add-ons/kernel/drivers/misc/mem.c | 21 ++++++++++++++++----- 1 file changed, 16 insertions(+), 5 deletions(-) diff --git a/src/add-ons/kernel/drivers/misc/mem.c b/src/add-ons/kernel/drivers/misc/mem.c index d3c3130dfd..2c095a003a 100644 --- a/src/add-ons/kernel/drivers/misc/mem.c +++ b/src/add-ons/kernel/drivers/misc/mem.c @@ -1,13 +1,17 @@ /* - * Copyright 2007, Haiku, Inc. All rights reserved. + * Copyright 2007-2019, Haiku, Inc. All rights reserved. * Distributed under the terms of the MIT License. */ + + #include #include + #include #include #include + #define DRIVER_NAME "mem" #define DEVICE_NAME "misc/mem" @@ -45,6 +49,7 @@ device_hooks mem_hooks = { int32 api_version = B_CUR_DRIVER_API_VERSION; + status_t init_hardware(void) { @@ -107,6 +112,7 @@ mem_read(void* cookie, off_t position, void* buffer, size_t* numBytes) { void *virtualAddress; area_id area; + status_t status = B_OK; /* check permissions */ if (getuid() != 0 && geteuid() != 0) { @@ -120,9 +126,11 @@ mem_read(void* cookie, off_t position, void* buffer, size_t* numBytes) return area; } - memcpy(buffer, virtualAddress, *numBytes); + if (user_memcpy(buffer, virtualAddress, *numBytes) != B_OK) + status = B_BAD_ADDRESS; + delete_area(area); - return B_OK; + return status; } @@ -131,6 +139,7 @@ mem_write(void* cookie, off_t position, const void* buffer, size_t* numBytes) { void *virtualAddress; area_id area; + status_t status = B_OK; /* check permissions */ if (getuid() != 0 && geteuid() != 0) { @@ -144,9 +153,11 @@ mem_write(void* cookie, off_t position, const void* buffer, size_t* numBytes) return area; } - memcpy(virtualAddress, buffer, *numBytes); + if (user_memcpy(virtualAddress, buffer, *numBytes) != B_OK) + status = B_BAD_ADDRESS; + delete_area(area); - return B_OK; + return status; }