On Tue, Feb 25, 2025 at 05:47:06PM -0800, Harish Chegondi wrote:
> +static int xe_eu_stall_user_ext_set_property(struct xe_device *xe, u64
> extension,
> + struct eu_stall_open_properties
> *props)
> +{
> + u64 __user *address = u64_to_user_ptr(extension);
> + struct drm_xe_ext_set_property ext;
> + int err;
> + u32 idx;
> +
> + err = __copy_from_user(&ext, address, sizeof(ext));
Why is this safe? (i.e. why is it not copy_from_user()?) I see no
access_ok() check anywhere in the ioctl call path to this function.
--
Kees Cook
