From cf6760f20ccec7f99cc6c25c80b922819e1928cf Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=A9r=C3=B4me=20Duval?= <jerome.duval@gmail.com>
Date: Fri, 30 Nov 2018 21:18:12 +0100
Subject: [PATCH] userlandfs: Read()/Write() with user_memcpy().
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Change-Id: I8be72d5fb18228c0ee0394a3f906f7a50113d7ea
Reviewed-on: https://review.haiku-os.org/741
Reviewed-by: Axel Dörfler <axeld@pinc-software.de>
---
 .../file_systems/userlandfs/kernel_add_on/Volume.cpp   |  7 +++++--
 .../userlandfs/private/RequestAllocator.cpp            | 10 +++++++++-
 2 files changed, 14 insertions(+), 3 deletions(-)

diff --git a/src/add-ons/kernel/file_systems/userlandfs/kernel_add_on/Volume.cpp b/src/add-ons/kernel/file_systems/userlandfs/kernel_add_on/Volume.cpp
index e2e5b40071..21b9a76b3b 100644
--- a/src/add-ons/kernel/file_systems/userlandfs/kernel_add_on/Volume.cpp
+++ b/src/add-ons/kernel/file_systems/userlandfs/kernel_add_on/Volume.cpp
@@ -2179,8 +2179,11 @@ Volume::Read(void* _node, void* cookie, off_t pos, void* buffer,
 		|| reply->bytesRead > bufferSize) {
 		return B_BAD_DATA;
 	}
-	if (reply->bytesRead > 0)
-		memcpy(buffer, readBuffer, reply->bytesRead);
+	if (reply->bytesRead > 0
+		&& user_memcpy(buffer, readBuffer, reply->bytesRead) < B_OK) {
+		return B_BAD_ADDRESS;
+	}
+
 	*bytesRead = reply->bytesRead;
 	_SendReceiptAck(port);
 	return error;
diff --git a/src/add-ons/kernel/file_systems/userlandfs/private/RequestAllocator.cpp b/src/add-ons/kernel/file_systems/userlandfs/private/RequestAllocator.cpp
index 348b16232f..d78f7c7e27 100644
--- a/src/add-ons/kernel/file_systems/userlandfs/private/RequestAllocator.cpp
+++ b/src/add-ons/kernel/file_systems/userlandfs/private/RequestAllocator.cpp
@@ -6,6 +6,8 @@
 #include <stdlib.h>
 #include <KernelExport.h>
 
+#include <kernel.h>
+
 #include "AreaSupport.h"
 #include "Compatibility.h"
 #include "Debug.h"
@@ -279,8 +281,14 @@ RequestAllocator::AllocateData(Address& address, const void* data, int32 size,
 			deferredInit);
 		if (error != B_OK)
 			return error;
-		if (size > 0)
+		if (size > 0) {
+#ifndef _KERNEL_MODE
 			memcpy(destination, data, size);
+#else
+			if (user_memcpy(destination, data, size) < B_OK)
+				return B_BAD_ADDRESS;
+#endif
+		}
 	} else
 		address.SetTo(-1, 0, 0);
 	return error;