hc
2024-05-10 37f49e37ab4cb5d0bc4c60eb5c6d4dd57db767bb
kernel/drivers/rpmsg/rpmsg_char.c
....@@ -146,7 +146,6 @@
146146 {
147147 struct rpmsg_eptdev *eptdev = cdev_to_eptdev(inode->i_cdev);
148148 struct device *dev = &eptdev->dev;
149
- struct sk_buff *skb;
150149
151150 /* Close the endpoint, if it's not already destroyed by the parent */
152151 mutex_lock(&eptdev->ept_lock);
....@@ -157,19 +156,16 @@
157156 mutex_unlock(&eptdev->ept_lock);
158157
159158 /* Discard all SKBs */
160
- while (!skb_queue_empty(&eptdev->queue)) {
161
- skb = skb_dequeue(&eptdev->queue);
162
- kfree_skb(skb);
163
- }
159
+ skb_queue_purge(&eptdev->queue);
164160
165161 put_device(dev);
166162
167163 return 0;
168164 }
169165
170
-static ssize_t rpmsg_eptdev_read(struct file *filp, char __user *buf,
171
- size_t len, loff_t *f_pos)
166
+static ssize_t rpmsg_eptdev_read_iter(struct kiocb *iocb, struct iov_iter *to)
172167 {
168
+ struct file *filp = iocb->ki_filp;
173169 struct rpmsg_eptdev *eptdev = filp->private_data;
174170 unsigned long flags;
175171 struct sk_buff *skb;
....@@ -205,8 +201,8 @@
205201 if (!skb)
206202 return -EFAULT;
207203
208
- use = min_t(size_t, len, skb->len);
209
- if (copy_to_user(buf, skb->data, use))
204
+ use = min_t(size_t, iov_iter_count(to), skb->len);
205
+ if (copy_to_iter(skb->data, use, to) != use)
210206 use = -EFAULT;
211207
212208 kfree_skb(skb);
....@@ -214,16 +210,23 @@
214210 return use;
215211 }
216212
217
-static ssize_t rpmsg_eptdev_write(struct file *filp, const char __user *buf,
218
- size_t len, loff_t *f_pos)
213
+static ssize_t rpmsg_eptdev_write_iter(struct kiocb *iocb,
214
+ struct iov_iter *from)
219215 {
216
+ struct file *filp = iocb->ki_filp;
220217 struct rpmsg_eptdev *eptdev = filp->private_data;
218
+ size_t len = iov_iter_count(from);
221219 void *kbuf;
222220 int ret;
223221
224
- kbuf = memdup_user(buf, len);
225
- if (IS_ERR(kbuf))
226
- return PTR_ERR(kbuf);
222
+ kbuf = kzalloc(len, GFP_KERNEL);
223
+ if (!kbuf)
224
+ return -ENOMEM;
225
+
226
+ if (!copy_from_iter_full(kbuf, len, from)) {
227
+ ret = -EFAULT;
228
+ goto free_kbuf;
229
+ }
227230
228231 if (mutex_lock_interruptible(&eptdev->ept_lock)) {
229232 ret = -ERESTARTSYS;
....@@ -281,11 +284,11 @@
281284 .owner = THIS_MODULE,
282285 .open = rpmsg_eptdev_open,
283286 .release = rpmsg_eptdev_release,
284
- .read = rpmsg_eptdev_read,
285
- .write = rpmsg_eptdev_write,
287
+ .read_iter = rpmsg_eptdev_read_iter,
288
+ .write_iter = rpmsg_eptdev_write_iter,
286289 .poll = rpmsg_eptdev_poll,
287290 .unlocked_ioctl = rpmsg_eptdev_ioctl,
288
- .compat_ioctl = rpmsg_eptdev_ioctl,
291
+ .compat_ioctl = compat_ptr_ioctl,
289292 };
290293
291294 static ssize_t name_show(struct device *dev, struct device_attribute *attr,
....@@ -439,7 +442,7 @@
439442 .open = rpmsg_ctrldev_open,
440443 .release = rpmsg_ctrldev_release,
441444 .unlocked_ioctl = rpmsg_ctrldev_ioctl,
442
- .compat_ioctl = rpmsg_ctrldev_ioctl,
445
+ .compat_ioctl = compat_ptr_ioctl,
443446 };
444447
445448 static void rpmsg_ctrldev_release_device(struct device *dev)