intel_extreme: Fix instances of user memory creation and access.

You still cannot boot to desktop under SMAP on intel_extreme, however,
as the agp_gart bus has not been patched properly. Doing so breaks the
intel_extreme accelerant, so more investigation is needed.

src/add-ons/kernel/drivers/graphics/intel_extreme/device.cpp

@@ -186,18 +186,23 @@ device_ioctl(void* data, uint32 op, void* buffer, size_t bufferLength)
 
 	switch (op) {
 		case B_GET_ACCELERANT_SIGNATURE:
-			strcpy((char*)buffer, INTEL_ACCELERANT_NAME);
 			TRACE("accelerant: %s\n", INTEL_ACCELERANT_NAME);
+			if (user_strlcpy((char*)buffer, INTEL_ACCELERANT_NAME,
+					B_FILE_NAME_LENGTH) < B_OK)
+				return B_BAD_ADDRESS;
 			return B_OK;
 
 		// needed to share data between kernel and accelerant
 		case INTEL_GET_PRIVATE_DATA:
 		{
-			intel_get_private_data* data = (intel_get_private_data* )buffer;
+			intel_get_private_data data;
+			if (user_memcpy(&data, buffer, sizeof(intel_get_private_data)) < B_OK)
+				return B_BAD_ADDRESS;
 
-			if (data->magic == INTEL_PRIVATE_DATA_MAGIC) {
+			if (data.magic == INTEL_PRIVATE_DATA_MAGIC) {
-				data->shared_info_area = info->shared_area;
+				data.shared_info_area = info->shared_area;
-				return B_OK;
+				return user_memcpy(buffer, &data,
+					sizeof(intel_get_private_data));
 			}
 			break;
 		}

src/add-ons/kernel/drivers/graphics/intel_extreme/intel_extreme.cpp

@@ -316,7 +316,7 @@ intel_extreme_init(intel_info &info)
 	info.shared_area = sharedCreator.Create("intel extreme shared info",
 		(void**)&info.shared_info, B_ANY_KERNEL_ADDRESS,
 		ROUND_TO_PAGE_SIZE(sizeof(intel_shared_info)) + 3 * B_PAGE_SIZE,
-		B_FULL_LOCK, 0);
+		B_FULL_LOCK, B_KERNEL_READ_AREA | B_KERNEL_WRITE_AREA | B_USER_CLONEABLE_AREA);
 	if (info.shared_area < B_OK) {
 		ERROR("error: could not create shared area!\n");
 		gGART->unmap_aperture(info.aperture);