write in 30M

hc

2024-02-20 ea08eeccae9297f7aabd2ef7f0c2517ac4549acc

 kernel/drivers/rpmsg/rpmsg_char.c
..
..
@@ -146,7 +146,6 @@
146
146
 {
147
147
 	struct rpmsg_eptdev *eptdev = cdev_to_eptdev(inode->i_cdev);
148
148
 	struct device *dev = &eptdev->dev;
149
-	struct sk_buff *skb;
150
149
 
151
150
 	/* Close the endpoint, if it's not already destroyed by the parent */
152
151
 	mutex_lock(&eptdev->ept_lock);
..
..
@@ -157,19 +156,16 @@
157
156
 	mutex_unlock(&eptdev->ept_lock);
158
157
 
159
158
 	/* Discard all SKBs */
160
-	while (!skb_queue_empty(&eptdev->queue)) {
161
-		skb = skb_dequeue(&eptdev->queue);
162
-		kfree_skb(skb);
163
-	}
159
+	skb_queue_purge(&eptdev->queue);
164
160
 
165
161
 	put_device(dev);
166
162
 
167
163
 	return 0;
168
164
 }
169
165
 
170
-static ssize_t rpmsg_eptdev_read(struct file *filp, char __user *buf,
171
-				 size_t len, loff_t *f_pos)
166
+static ssize_t rpmsg_eptdev_read_iter(struct kiocb *iocb, struct iov_iter *to)
172
167
 {
168
+	struct file *filp = iocb->ki_filp;
173
169
 	struct rpmsg_eptdev *eptdev = filp->private_data;
174
170
 	unsigned long flags;
175
171
 	struct sk_buff *skb;
..
..
@@ -205,8 +201,8 @@
205
201
 	if (!skb)
206
202
 		return -EFAULT;
207
203
 
208
-	use = min_t(size_t, len, skb->len);
209
-	if (copy_to_user(buf, skb->data, use))
204
+	use = min_t(size_t, iov_iter_count(to), skb->len);
205
+	if (copy_to_iter(skb->data, use, to) != use)
210
206
 		use = -EFAULT;
211
207
 
212
208
 	kfree_skb(skb);
..
..
@@ -214,16 +210,23 @@
214
210
 	return use;
215
211
 }
216
212
 
217
-static ssize_t rpmsg_eptdev_write(struct file *filp, const char __user *buf,
218
-				  size_t len, loff_t *f_pos)
213
+static ssize_t rpmsg_eptdev_write_iter(struct kiocb *iocb,
214
+				       struct iov_iter *from)
219
215
 {
216
+	struct file *filp = iocb->ki_filp;
220
217
 	struct rpmsg_eptdev *eptdev = filp->private_data;
218
+	size_t len = iov_iter_count(from);
221
219
 	void *kbuf;
222
220
 	int ret;
223
221
 
224
-	kbuf = memdup_user(buf, len);
225
-	if (IS_ERR(kbuf))
226
-		return PTR_ERR(kbuf);
222
+	kbuf = kzalloc(len, GFP_KERNEL);
223
+	if (!kbuf)
224
+		return -ENOMEM;
225
+
226
+	if (!copy_from_iter_full(kbuf, len, from)) {
227
+		ret = -EFAULT;
228
+		goto free_kbuf;
229
+	}
227
230
 
228
231
 	if (mutex_lock_interruptible(&eptdev->ept_lock)) {
229
232
 		ret = -ERESTARTSYS;
..
..
@@ -281,11 +284,11 @@
281
284
 	.owner = THIS_MODULE,
282
285
 	.open = rpmsg_eptdev_open,
283
286
 	.release = rpmsg_eptdev_release,
284
-	.read = rpmsg_eptdev_read,
285
-	.write = rpmsg_eptdev_write,
287
+	.read_iter = rpmsg_eptdev_read_iter,
288
+	.write_iter = rpmsg_eptdev_write_iter,
286
289
 	.poll = rpmsg_eptdev_poll,
287
290
 	.unlocked_ioctl = rpmsg_eptdev_ioctl,
288
-	.compat_ioctl = rpmsg_eptdev_ioctl,
291
+	.compat_ioctl = compat_ptr_ioctl,
289
292
 };
290
293
 
291
294
 static ssize_t name_show(struct device *dev, struct device_attribute *attr,
..
..
@@ -439,7 +442,7 @@
439
442
 	.open = rpmsg_ctrldev_open,
440
443
 	.release = rpmsg_ctrldev_release,
441
444
 	.unlocked_ioctl = rpmsg_ctrldev_ioctl,
442
-	.compat_ioctl = rpmsg_ctrldev_ioctl,
445
+	.compat_ioctl = compat_ptr_ioctl,
443
446
 };
444
447
 
445
448
 static void rpmsg_ctrldev_release_device(struct device *dev)