mic: vop: copy data to kernel space then write to io memory

[ Upstream commit 675f0ad4046946e80412896436164d172cd92238 ]

Read and write io memory should address align on ARCH ARM. Change to use
memcpy_toio to avoid kernel panic caused by the address un-align issue.

Signed-off-by: Sherry Sun <sherry.sun@nxp.com>
Signed-off-by: Joakim Zhang <qiangqing.zhang@nxp.com>
Link: https://lore.kernel.org/r/20200929091106.24624-5-sherry.sun@nxp.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/drivers/misc/mic/vop/vop_vringh.c b/drivers/misc/mic/vop/vop_vringh.c
index 30eac172f0170ecad1c7e900436b315e1085ae7c..d069947b09345a64a1966179766ab6283082b5de 100644 (file)
--- a/drivers/misc/mic/vop/vop_vringh.c
+++ b/drivers/misc/mic/vop/vop_vringh.c
@@ -602,6 +602,7 @@ static int vop_virtio_copy_from_user(struct vop_vdev *vdev, void __user *ubuf,
        size_t partlen;
        bool dma = VOP_USE_DMA && vi->dma_ch;
        int err = 0;
+       size_t offset = 0;
 
        if (dma) {
                dma_alignment = 1 << vi->dma_ch->device->copy_align;
@@ -655,13 +656,20 @@ memcpy:
         * We are copying to IO below and should ideally use something
         * like copy_from_user_toio(..) if it existed.
         */
-       if (copy_from_user((void __force *)dbuf, ubuf, len)) {
-               err = -EFAULT;
-               dev_err(vop_dev(vdev), "%s %d err %d\n",
-                       __func__, __LINE__, err);
-               goto err;
+       while (len) {
+               partlen = min_t(size_t, len, VOP_INT_DMA_BUF_SIZE);
+
+               if (copy_from_user(vvr->buf, ubuf + offset, partlen)) {
+                       err = -EFAULT;
+                       dev_err(vop_dev(vdev), "%s %d err %d\n",
+                               __func__, __LINE__, err);
+                       goto err;
+               }
+               memcpy_toio(dbuf + offset, vvr->buf, partlen);
+               offset += partlen;
+               vdev->out_bytes += partlen;
+               len -= partlen;
        }
-       vdev->out_bytes += len;
        err = 0;
 err:
        vpdev->hw_ops->unmap(vpdev, dbuf);