For the COMEDI_DEVCONFIG ioctl, the user application may embed a pointer
to firmware data within a designated element (or two elements for 64-bit
pointers) of the `options[]` array in the `struct comedi_devconfig`.
`do_devconfig_ioctl()` calls `comedi_aux_data()` to extract the pointer
value. It needs to be treated as a `__user` pointer so the firmware
data can be copied into kernel memory, so cast the result of
`comedi_aux_data()` to avoid a "sparse" warning. This is not ideal but
`comedi_aux_data()` is called elsewhere in a wholly kernel memory
context so we can't just change its return type to include the `__user`
tag.
Signed-off-by: Ian Abbott <abbotti@mev.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
return -ENOMEM;
if (copy_from_user(aux_data,
- comedi_aux_data(it.options, 0), aux_len)) {
+ (unsigned char __user *
+ )comedi_aux_data(it.options, 0), aux_len)) {
vfree(aux_data);
return -EFAULT;
}