From c61fa718f28a2e7cf8aa3eb3ad27e67362c53be9 Mon Sep 17 00:00:00 2001 From: Augustin Cavalier Date: Sun, 17 Feb 2019 13:07:07 -0500 Subject: [PATCH] usb_disk: Handle user buffer-to-partial buffer copies correctly. Discovered by an SMAP violation triggered by running "writembr" on a USB drive. --- .../kernel/drivers/disk/usb/usb_disk/usb_disk.cpp | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/src/add-ons/kernel/drivers/disk/usb/usb_disk/usb_disk.cpp b/src/add-ons/kernel/drivers/disk/usb/usb_disk/usb_disk.cpp index 3731e6b68a..dd26443288 100644 --- a/src/add-ons/kernel/drivers/disk/usb/usb_disk/usb_disk.cpp +++ b/src/add-ons/kernel/drivers/disk/usb/usb_disk/usb_disk.cpp @@ -16,6 +16,7 @@ #include #include +#include #include #include "scsi_sense.h" @@ -2027,7 +2028,10 @@ usb_disk_read(void *cookie, off_t position, void *buffer, size_t *length) result = usb_disk_prepare_partial_buffer(lun, position, *length, partialBuffer, blockBuffer, blockPosition, blockCount); if (result == B_OK) { - memcpy(buffer, partialBuffer, *length); + if (IS_USER_ADDRESS(buffer)) + result = user_memcpy(buffer, partialBuffer, *length); + else + memcpy(buffer, partialBuffer, *length); free(blockBuffer); } } else { @@ -2075,7 +2079,12 @@ usb_disk_write(void *cookie, off_t position, const void *buffer, result = usb_disk_prepare_partial_buffer(lun, position, *length, partialBuffer, blockBuffer, blockPosition, blockCount); if (result == B_OK) { - memcpy(partialBuffer, buffer, *length); + if (IS_USER_ADDRESS(buffer)) + result = user_memcpy(partialBuffer, buffer, *length); + else + memcpy(partialBuffer, buffer, *length); + } + if (result == B_OK) { size_t blockLength = blockCount * lun->block_size; result = usb_disk_block_write(lun, blockPosition, blockCount, blockBuffer, &blockLength);