From 91ef6b614c4f655aea72368f5430bfc5baa846a0 Mon Sep 17 00:00:00 2001 From: Paul Lawrence Date: Fri, 3 Apr 2020 11:17:53 -0700 Subject: [PATCH] ANDROID: Incremental fs: Fix mislabeled __user ptrs Found by sparse Bug: 153174547 Test: make C=2 fs/incfs/incrementalfs.ko no errors, incfs_test pass Signed-off-by: Paul Lawrence Change-Id: I9ff4f4f35975fe09936724488b96cd8bdeeb719e --- fs/incfs/data_mgmt.c | 5 +++-- fs/incfs/integrity.c | 2 +- fs/incfs/vfs.c | 4 ++-- 3 files changed, 6 insertions(+), 5 deletions(-) diff --git a/fs/incfs/data_mgmt.c b/fs/incfs/data_mgmt.c index 91541b46f771..eac949243fd9 100644 --- a/fs/incfs/data_mgmt.c +++ b/fs/incfs/data_mgmt.c @@ -396,7 +396,8 @@ static int copy_one_range(struct incfs_filled_range *range, void __user *buffer, if (error) return error; - if (copy_to_user(((char *)buffer) + *size_out, range, sizeof(*range))) + if (copy_to_user(((char __user *)buffer) + *size_out, range, + sizeof(*range))) return -EFAULT; *size_out += sizeof(*range); @@ -437,7 +438,7 @@ int incfs_get_filled_blocks(struct data_file *df, int error = 0; bool in_range = false; struct incfs_filled_range range; - void *buffer = u64_to_user_ptr(arg->range_buffer); + void __user *buffer = u64_to_user_ptr(arg->range_buffer); u32 size = arg->range_buffer_size; u32 end_index = arg->end_index ? arg->end_index : df->df_total_block_count; diff --git a/fs/incfs/integrity.c b/fs/incfs/integrity.c index 96e016a91542..d049988ef037 100644 --- a/fs/incfs/integrity.c +++ b/fs/incfs/integrity.c @@ -62,7 +62,7 @@ static bool read_u32(u8 **p, u8 *top, u32 *result) if (*p + sizeof(u32) > top) return false; - *result = le32_to_cpu(*(u32 *)*p); + *result = le32_to_cpu(*(__le32 *)*p); *p += sizeof(u32); return true; } diff --git a/fs/incfs/vfs.c b/fs/incfs/vfs.c index cb4c787c825d..7ac3cbe34995 100644 --- a/fs/incfs/vfs.c +++ b/fs/incfs/vfs.c @@ -1277,7 +1277,7 @@ static long ioctl_fill_blocks(struct file *f, void __user *arg) { struct incfs_fill_blocks __user *usr_fill_blocks = arg; struct incfs_fill_blocks fill_blocks; - struct incfs_fill_block *usr_fill_block_array; + struct incfs_fill_block __user *usr_fill_block_array; struct data_file *df = get_incfs_data_file(f); const ssize_t data_buf_size = 2 * INCFS_DATA_FILE_BLOCK_SIZE; u8 *data_buf = NULL; @@ -1347,7 +1347,7 @@ static long ioctl_permit_fill(struct file *f, void __user *arg) struct incfs_permit_fill __user *usr_permit_fill = arg; struct incfs_permit_fill permit_fill; long error = 0; - struct file *file = 0; + struct file *file = NULL; if (f->f_op != &incfs_pending_read_file_ops) return -EPERM;