|
@@ -3781,6 +3781,7 @@ static int megasas_mgmt_compat_ioctl_fw(struct file *file, unsigned long arg)
|
|
|
compat_alloc_user_space(sizeof(struct megasas_iocpacket));
|
|
|
int i;
|
|
|
int error = 0;
|
|
|
+ compat_uptr_t ptr;
|
|
|
|
|
|
if (clear_user(ioc, sizeof(*ioc)))
|
|
|
return -EFAULT;
|
|
@@ -3793,9 +3794,22 @@ static int megasas_mgmt_compat_ioctl_fw(struct file *file, unsigned long arg)
|
|
|
copy_in_user(&ioc->sge_count, &cioc->sge_count, sizeof(u32)))
|
|
|
return -EFAULT;
|
|
|
|
|
|
- for (i = 0; i < MAX_IOCTL_SGE; i++) {
|
|
|
- compat_uptr_t ptr;
|
|
|
+ /*
|
|
|
+ * The sense_ptr is used in megasas_mgmt_fw_ioctl only when
|
|
|
+ * sense_len is not null, so prepare the 64bit value under
|
|
|
+ * the same condition.
|
|
|
+ */
|
|
|
+ if (ioc->sense_len) {
|
|
|
+ void __user **sense_ioc_ptr =
|
|
|
+ (void __user **)(ioc->frame.raw + ioc->sense_off);
|
|
|
+ compat_uptr_t *sense_cioc_ptr =
|
|
|
+ (compat_uptr_t *)(cioc->frame.raw + cioc->sense_off);
|
|
|
+ if (get_user(ptr, sense_cioc_ptr) ||
|
|
|
+ put_user(compat_ptr(ptr), sense_ioc_ptr))
|
|
|
+ return -EFAULT;
|
|
|
+ }
|
|
|
|
|
|
+ for (i = 0; i < MAX_IOCTL_SGE; i++) {
|
|
|
if (get_user(ptr, &cioc->sgl[i].iov_base) ||
|
|
|
put_user(compat_ptr(ptr), &ioc->sgl[i].iov_base) ||
|
|
|
copy_in_user(&ioc->sgl[i].iov_len,
|