memdup_user 236 arch/powerpc/platforms/powernv/opal-prd.c msg = memdup_user(buf, size); memdup_user 216 arch/s390/kvm/guestdbg.c bp_data = memdup_user(dbg->arch.hw_bp, memdup_user 108 arch/um/drivers/hostaudio_kern.c kbuf = memdup_user(buffer, count); memdup_user 2595 arch/x86/kvm/x86.c page = memdup_user(blob_addr + (page_num * PAGE_SIZE), PAGE_SIZE); memdup_user 3237 arch/x86/kvm/x86.c entries = memdup_user(user_msrs->entries, size); memdup_user 4213 arch/x86/kvm/x86.c u.lapic = memdup_user(argp, sizeof(*u.lapic)); memdup_user 4396 arch/x86/kvm/x86.c u.xsave = memdup_user(argp, sizeof(*u.xsave)); memdup_user 4421 arch/x86/kvm/x86.c u.xcrs = memdup_user(argp, sizeof(*u.xcrs)); memdup_user 4990 arch/x86/kvm/x86.c chip = memdup_user(argp, sizeof(*chip)); memdup_user 5014 arch/x86/kvm/x86.c chip = memdup_user(argp, sizeof(*chip)); memdup_user 43 block/bsg-lib.c job->request = memdup_user(uptr64(hdr->request), hdr->request_len); memdup_user 2458 block/sed-opal.c p = memdup_user(arg, _IOC_SIZE(cmd)); memdup_user 1733 drivers/block/mtip32xx/mtip32xx.c outbuf = memdup_user(buf + outtotal, taskout); memdup_user 1747 drivers/block/mtip32xx/mtip32xx.c inbuf = memdup_user(buf + intotal, taskin); memdup_user 191 drivers/block/rsxx/core.c buf = memdup_user(ubuf, cnt); memdup_user 3216 drivers/cdrom/cdrom.c s = memdup_user(arg, size); memdup_user 714 drivers/char/applicom.c adgl = memdup_user(argp, sizeof(struct st_ram_io)); memdup_user 275 drivers/char/nvram.c tmp = memdup_user(buf, count); memdup_user 422 drivers/crypto/ccp/psp-dev.c return memdup_user((void __user *)(uintptr_t)uaddr, len); memdup_user 242 drivers/dma-buf/udmabuf.c list = memdup_user((void __user *)(arg + sizeof(head)), lsize); memdup_user 76 drivers/firmware/efi/test/efi_test.c buf = memdup_user(src, len); memdup_user 265 drivers/firmware/efi/test/efi_test.c data = memdup_user(setvariable.data, setvariable.data_size); memdup_user 558 drivers/firmware/efi/test/efi_test.c data = memdup_user((void *)resetsystem.data, memdup_user 675 drivers/gpu/drm/amd/amdkfd/kfd_chardev.c args_buff = memdup_user(cmd_from_user, memdup_user 787 drivers/gpu/drm/amd/amdkfd/kfd_chardev.c args_buff = memdup_user(cmd_from_user, memdup_user 381 drivers/gpu/drm/drm_debugfs.c buf = memdup_user(ubuf, len); memdup_user 520 drivers/gpu/drm/drm_lease.c object_ids = memdup_user(u64_to_user_ptr(cl->object_ids), memdup_user 1506 drivers/gpu/drm/i915/gvt/kvmgt.c data = memdup_user((void __user *)(arg + minsz), memdup_user 911 drivers/gpu/drm/r128/r128_state.c buffer = memdup_user(depth->buffer, buffer_size); memdup_user 917 drivers/gpu/drm/r128/r128_state.c mask = memdup_user(depth->mask, mask_size); memdup_user 992 drivers/gpu/drm/r128/r128_state.c x = memdup_user(depth->x, xbuf_size); memdup_user 995 drivers/gpu/drm/r128/r128_state.c y = memdup_user(depth->y, ybuf_size); memdup_user 1001 drivers/gpu/drm/r128/r128_state.c buffer = memdup_user(depth->buffer, buffer_size); memdup_user 1010 drivers/gpu/drm/r128/r128_state.c mask = memdup_user(depth->mask, mask_size); memdup_user 1015 drivers/gpu/drm/savage/savage_state.c kvb_addr = memdup_user(cmdbuf->vb_addr, cmdbuf->vb_size); memdup_user 200 drivers/gpu/drm/virtio/virtgpu_ioctl.c buf = memdup_user(u64_to_user_ptr(exbuf->command), exbuf->size); memdup_user 781 drivers/gpu/drm/vmwgfx/vmwgfx_surface.c srf->sizes = memdup_user((struct drm_vmw_size __user *)(unsigned long) memdup_user 133 drivers/hid/hidraw.c buf = memdup_user(buffer, count); memdup_user 83 drivers/hv/hv_utils_transport.c inmsg = memdup_user(buf, count); memdup_user 168 drivers/i2c/i2c-dev.c tmp = memdup_user(buf, count); memdup_user 256 drivers/i2c/i2c-dev.c msgs[i].buf = memdup_user(data_ptrs[i], msgs[i].len); memdup_user 448 drivers/i2c/i2c-dev.c rdwr_pa = memdup_user(rdwr_arg.msgs, memdup_user 478 drivers/ide/ide-taskfile.c req_task = memdup_user(buf, tasksize); memdup_user 1379 drivers/infiniband/core/ucma.c optval = memdup_user(u64_to_user_ptr(cmd.optval), memdup_user 787 drivers/infiniband/hw/hfi1/debugfs.c buff = memdup_user(buf, count); memdup_user 894 drivers/infiniband/hw/hfi1/debugfs.c buff = memdup_user(buf, count); memdup_user 517 drivers/infiniband/hw/hfi1/user_exp_rcv.c tidinfo = memdup_user(u64_to_user_ptr(tinfo->tidlist), memdup_user 562 drivers/infiniband/hw/hfi1/user_sdma.c tmp = memdup_user(iovec[idx].iov_base, memdup_user 335 drivers/infiniband/hw/qib/qib_fs.c tmp = memdup_user(buf, count); memdup_user 455 drivers/input/joydev.c abspam = memdup_user(argp, len); memdup_user 486 drivers/input/joydev.c keypam = memdup_user(argp, len); memdup_user 528 drivers/input/misc/uinput.c user_dev = memdup_user(buffer, sizeof(struct uinput_user_dev)); memdup_user 1264 drivers/lightnvm/core.c info = memdup_user(arg, sizeof(struct nvm_ioctl_info)); memdup_user 1156 drivers/media/dvb-core/dvb_demux.c p = memdup_user(buf, count); memdup_user 2091 drivers/media/dvb-core/dvb_frontend.c tvp = memdup_user(compat_ptr(tvps->props), tvps->num * sizeof(*tvp)); memdup_user 2122 drivers/media/dvb-core/dvb_frontend.c tvp = memdup_user(compat_ptr(tvps->props), tvps->num * sizeof(*tvp)); memdup_user 2339 drivers/media/dvb-core/dvb_frontend.c tvp = memdup_user((void __user *)tvps->props, tvps->num * sizeof(*tvp)); memdup_user 2417 drivers/media/dvb-core/dvb_frontend.c tvp = memdup_user((void __user *)tvps->props, tvps->num * sizeof(*tvp)); memdup_user 325 drivers/media/rc/lirc_dev.c txbuf = memdup_user(buf, n); memdup_user 68 drivers/media/usb/uvc/uvc_v4l2.c map->menu_info = memdup_user(xmap->menu_info, size); memdup_user 1249 drivers/message/fusion/mptctl.c karg = memdup_user(uarg, data_size); memdup_user 937 drivers/misc/mic/vop/vop_vringh.c dd_config = memdup_user(argp, mic_desc_size(&dd)); memdup_user 992 drivers/misc/mic/vop/vop_vringh.c buf = memdup_user(argp, vdev->dd->config_len); memdup_user 376 drivers/misc/vmw_vmci/vmci_host.c dg = memdup_user((void __user *)(uintptr_t)send_info.addr, memdup_user 745 drivers/misc/vmw_vmci/vmci_host.c cpt_buf = memdup_user((void __user *)(uintptr_t)set_info.cpt_buf, memdup_user 378 drivers/mmc/core/block.c idata->buf = memdup_user((void __user *)(unsigned long) memdup_user 375 drivers/mtd/mtdchar.c ops.oobbuf = memdup_user(ptr, length); memdup_user 609 drivers/mtd/mtdchar.c ops.datbuf = memdup_user(usr_data, ops.len); memdup_user 617 drivers/mtd/mtdchar.c ops.oobbuf = memdup_user(usr_oob, ops.ooblen); memdup_user 315 drivers/net/ethernet/brocade/bna/bnad_debugfs.c kern_buf = memdup_user(buf, nbytes); memdup_user 375 drivers/net/ethernet/brocade/bna/bnad_debugfs.c kern_buf = memdup_user(buf, nbytes); memdup_user 2355 drivers/net/ethernet/chelsio/cxgb3/cxgb3_main.c fw_data = memdup_user(useraddr + sizeof(t), t.len); memdup_user 1285 drivers/net/ethernet/mellanox/mlx5/core/cmd.c ptr = memdup_user(buf, count); memdup_user 950 drivers/net/hamradio/yam.c ym = memdup_user(ifr->ifr_data, memdup_user 1611 drivers/net/hippi/rrunner.c image = memdup_user(rq->ifr_data, EEPROM_BYTES); memdup_user 572 drivers/net/ppp/ppp_generic.c code = memdup_user(uprog.filter, len); memdup_user 930 drivers/net/tun.c addr = memdup_user(arg + sizeof(uf), alen); memdup_user 2029 drivers/net/wan/farsync.c buf = memdup_user(ifr->ifr_data + sizeof(struct fstioc_write), memdup_user 494 drivers/net/wan/lmc/lmc_main.c data = memdup_user(xc.data, xc.len); memdup_user 1215 drivers/net/wan/sdla.c temp = memdup_user(mem.data, mem.len); memdup_user 992 drivers/net/wireless/ath/wil6210/debugfs.c frame = memdup_user(buf, len); memdup_user 2650 drivers/net/wireless/atmel/atmel.c new_firmware = memdup_user(com.data, com.len); memdup_user 3045 drivers/net/wireless/intersil/hostap/hostap_ioctl.c param = memdup_user(p->pointer, p->length); memdup_user 3803 drivers/net/wireless/intersil/hostap/hostap_ioctl.c param = memdup_user(p->pointer, p->length); memdup_user 1165 drivers/net/wireless/ti/wlcore/debugfs.c buf = memdup_user(user_buf, bytes); memdup_user 254 drivers/ptp/ptp_chardev.c extoff = memdup_user((void __user *)arg, sizeof(*extoff)); memdup_user 282 drivers/ptp/ptp_chardev.c sysoff = memdup_user((void __user *)arg, sizeof(*sysoff)); memdup_user 1844 drivers/rapidio/rio_cm.c buf = memdup_user((void __user *)(uintptr_t)msg.msg, msg.size); memdup_user 316 drivers/s390/char/tape_3590.c ext_kekls = memdup_user((char __user *)arg, sizeof(*ext_kekls)); memdup_user 253 drivers/scsi/bfa/bfad_debugfs.c kern_buf = memdup_user(buf, nbytes); memdup_user 320 drivers/scsi/bfa/bfad_debugfs.c kern_buf = memdup_user(buf, nbytes); memdup_user 1288 drivers/scsi/esas2r/esas2r_ioctl.c ioctl = memdup_user(arg, sizeof(struct atto_express_ioctl)); memdup_user 8267 drivers/scsi/megaraid/megaraid_sas_base.c ioc = memdup_user(user_ioc, sizeof(*ioc)); memdup_user 167 drivers/scsi/qedf/qedf_debugfs.c kern_buf = memdup_user(buffer, count); memdup_user 220 drivers/scsi/qedf/qedf_debugfs.c kern_buf = memdup_user(buffer, 6); memdup_user 332 drivers/spi/spidev.c return memdup_user(u_ioc, tmp); memdup_user 1738 drivers/staging/comedi/comedi_fops.c chanlist = memdup_user(user_chanlist, memdup_user 224 drivers/staging/greybus/authentication.c ims_cert = memdup_user(buf, size); memdup_user 240 drivers/staging/greybus/authentication.c authenticate = memdup_user(buf, size); memdup_user 144 drivers/staging/rtl8188eu/os_dep/rtw_android.c command = memdup_user(priv_cmd.buf, priv_cmd.total_len); memdup_user 2990 drivers/staging/rtl8192u/ieee80211/ieee80211_softmac.c param = memdup_user(p->pointer, p->length); memdup_user 3541 drivers/staging/rtl8192u/r8192U_core.c ipw = memdup_user(p->pointer, p->length); memdup_user 931 drivers/staging/rtl8712/rtl871x_ioctl_linux.c ext = memdup_user(dwrq->pointer, len); memdup_user 1885 drivers/staging/rtl8712/rtl871x_ioctl_linux.c pparmbuf = memdup_user(p->pointer, len); memdup_user 2154 drivers/staging/rtl8712/rtl871x_ioctl_linux.c param = memdup_user(p->pointer, p->length); memdup_user 1736 drivers/tty/vt/keyboard.c dia = memdup_user(a->kbdiacr, memdup_user 1774 drivers/tty/vt/keyboard.c buf = memdup_user(a->kbdiacruc, memdup_user 4538 drivers/tty/vt/vt.c font.data = memdup_user(op->data, size); memdup_user 365 drivers/usb/class/cdc-wdm.c buf = memdup_user(buffer, count); memdup_user 1634 drivers/usb/core/devio.c isopkt = memdup_user(iso_frame_desc, isofrmlen); memdup_user 1811 drivers/usb/gadget/legacy/inode.c kbuf = memdup_user(buf, length); memdup_user 378 drivers/usb/misc/iowarrior.c buf = memdup_user(user_buffer, count); memdup_user 922 drivers/vfio/pci/vfio_pci.c data = memdup_user((void __user *)(arg + minsz), memdup_user 382 drivers/vfio/platform/vfio_platform_common.c data = memdup_user((void __user *)(arg + minsz), memdup_user 577 drivers/video/fbdev/via/viafbdev.c viafb_gamma_table = memdup_user(argp, 256 * sizeof(u32)); memdup_user 93 fs/autofs/dev-ioctl.c res = memdup_user(in, tmp.size); memdup_user 1626 fs/btrfs/ioctl.c vol_args = memdup_user(arg, sizeof(*vol_args)); memdup_user 1809 fs/btrfs/ioctl.c vol_args = memdup_user(arg, sizeof(*vol_args)); memdup_user 1835 fs/btrfs/ioctl.c vol_args = memdup_user(arg, sizeof(*vol_args)); memdup_user 1863 fs/btrfs/ioctl.c inherit = memdup_user(vol_args->qgroup_inherit, vol_args->size); memdup_user 2545 fs/btrfs/ioctl.c args = memdup_user(argp, sizeof(*args)); memdup_user 2598 fs/btrfs/ioctl.c args = memdup_user(argp, sizeof(*args)); memdup_user 2764 fs/btrfs/ioctl.c rootrefs = memdup_user(argp, sizeof(*rootrefs)); memdup_user 2856 fs/btrfs/ioctl.c vol_args = memdup_user(arg, sizeof(*vol_args)); memdup_user 3035 fs/btrfs/ioctl.c vol_args = memdup_user(arg, sizeof(*vol_args)); memdup_user 3067 fs/btrfs/ioctl.c vol_args = memdup_user(arg, sizeof(*vol_args)); memdup_user 3126 fs/btrfs/ioctl.c vol_args = memdup_user(arg, sizeof(*vol_args)); memdup_user 3187 fs/btrfs/ioctl.c di_args = memdup_user(arg, sizeof(*di_args)); memdup_user 4244 fs/btrfs/ioctl.c sa = memdup_user(arg, sizeof(*sa)); memdup_user 4297 fs/btrfs/ioctl.c sa = memdup_user(arg, sizeof(*sa)); memdup_user 4316 fs/btrfs/ioctl.c sa = memdup_user(arg, sizeof(*sa)); memdup_user 4343 fs/btrfs/ioctl.c p = memdup_user(arg, sizeof(*p)); memdup_user 4399 fs/btrfs/ioctl.c ipa = memdup_user(arg, sizeof(*ipa)); memdup_user 4472 fs/btrfs/ioctl.c loi = memdup_user(arg, sizeof(*loi)); memdup_user 4617 fs/btrfs/ioctl.c bargs = memdup_user(arg, sizeof(*bargs)); memdup_user 4758 fs/btrfs/ioctl.c sa = memdup_user(arg, sizeof(*sa)); memdup_user 4802 fs/btrfs/ioctl.c sa = memdup_user(arg, sizeof(*sa)); memdup_user 4852 fs/btrfs/ioctl.c sa = memdup_user(arg, sizeof(*sa)); memdup_user 4903 fs/btrfs/ioctl.c sa = memdup_user(arg, sizeof(*sa)); memdup_user 4948 fs/btrfs/ioctl.c qsa = memdup_user(arg, sizeof(*qsa)); memdup_user 5103 fs/btrfs/ioctl.c args32 = memdup_user(arg, sizeof(*args32)); memdup_user 5152 fs/btrfs/ioctl.c sa = memdup_user(arg, sizeof(*sa)); memdup_user 5436 fs/btrfs/ioctl.c arg = memdup_user(argp, sizeof(*arg)); memdup_user 2185 fs/btrfs/super.c vol = memdup_user((void __user *)arg, sizeof(*vol)); memdup_user 397 fs/ecryptfs/miscdev.c data = memdup_user(buf, count); memdup_user 35 fs/efivarfs/file.c data = memdup_user(userbuf + sizeof(attributes), datasize); memdup_user 607 fs/ioctl.c same = memdup_user(argp, size); memdup_user 819 fs/nfsd/nfs4recover.c name.data = memdup_user(&ci->cc_name.cn_id, namelen); memdup_user 825 fs/nfsd/nfs4recover.c princhash.data = memdup_user( memdup_user 839 fs/nfsd/nfs4recover.c name.data = memdup_user(&cnm->cn_id, namelen); memdup_user 899 fs/nilfs2/ioctl.c kbufs[4] = memdup_user((void __user *)(unsigned long)argv[4].v_base, memdup_user 2585 fs/proc/base.c page = memdup_user(buf, count); memdup_user 534 fs/pstore/platform.c record->buf = memdup_user(buf, record->size); memdup_user 469 fs/xfs/xfs_ioctl.c kbuf = memdup_user(ubuf, len); memdup_user 526 fs/xfs/xfs_ioctl.c ops = memdup_user(am_hreq.ops, size); memdup_user 440 fs/xfs/xfs_ioctl32.c ops = memdup_user(compat_ptr(am_hreq.ops), size); memdup_user 13 include/linux/string.h extern void *memdup_user(const void __user *, size_t); memdup_user 2827 include/rdma/ib_verbs.h buf = memdup_user(p, len); memdup_user 728 kernel/bpf/syscall.c return memdup_user(ukey, key_size); memdup_user 275 kernel/kexec_file.c image->cmdline_buf = memdup_user(cmdline_ptr, cmdline_len); memdup_user 183 mm/util.c EXPORT_SYMBOL(memdup_user); memdup_user 231 mm/util.c p = memdup_user(s, length); memdup_user 761 net/bluetooth/hidp/core.c session->rd_data = memdup_user(req->rd_data, req->rd_size); memdup_user 673 net/can/j1939/socket.c filters = memdup_user(optval, optlen); memdup_user 514 net/can/raw.c filter = memdup_user(optval, optlen); memdup_user 2330 net/core/ethtool.c data = memdup_user(useraddr, tuna.len); memdup_user 2518 net/core/ethtool.c data = memdup_user(useraddr, tuna.len); memdup_user 484 net/dccp/proto.c val = memdup_user(optval, optlen); memdup_user 942 net/ipv4/ip_sockglue.c msf = memdup_user(optval, optlen); memdup_user 1093 net/ipv4/ip_sockglue.c gsf = memdup_user(optval, optlen); memdup_user 423 net/ipv6/ipv6_sockglue.c new = memdup_user(optval, optlen); memdup_user 767 net/ipv6/ipv6_sockglue.c gsf = memdup_user(optval, optlen); memdup_user 1001 net/sctp/socket.c kaddrs = memdup_user(addrs, addrs_size); memdup_user 1320 net/sctp/socket.c kaddrs = memdup_user(addrs, addrs_size); memdup_user 3674 net/sctp/socket.c hmacs = memdup_user(optval, optlen); memdup_user 3713 net/sctp/socket.c authkey = memdup_user(optval, optlen); memdup_user 4216 net/sctp/socket.c params = memdup_user(optval, optlen); memdup_user 2284 net/xfrm/xfrm_state.c data = memdup_user(optval, optlen); memdup_user 1231 samples/vfio-mdev/mtty.c ptr = data = memdup_user((void __user *)(arg + minsz), memdup_user 238 security/keys/keyctl_pkey.c in = memdup_user(_in, params.in_len); memdup_user 300 security/keys/keyctl_pkey.c in = memdup_user(_in, params.in_len); memdup_user 306 security/keys/keyctl_pkey.c in2 = memdup_user(_in2, params.in2_len); memdup_user 2515 security/smack/smackfs.c data = memdup_user(buf, count); memdup_user 556 sound/core/compress_offload.c params = memdup_user((void __user *)arg, sizeof(*params)); memdup_user 874 sound/core/control.c control = memdup_user(_control, sizeof(*control)); memdup_user 934 sound/core/control.c control = memdup_user(_control, sizeof(*control)); memdup_user 517 sound/core/pcm_native.c params = memdup_user(_params, sizeof(*params)); memdup_user 748 sound/core/pcm_native.c params = memdup_user(_params, sizeof(*params)); memdup_user 2859 sound/core/pcm_native.c bufs = memdup_user(xfern.bufs, sizeof(void *) * runtime->channels); memdup_user 3619 sound/core/pcm_native.c oparams = memdup_user(_oparams, sizeof(*oparams)); memdup_user 3654 sound/core/pcm_native.c oparams = memdup_user(_oparams, sizeof(*oparams)); memdup_user 1615 sound/core/timer.c ginfo = memdup_user(_ginfo, sizeof(*ginfo)); memdup_user 168 sound/firewire/fireworks/fireworks_hwdep.c buf = memdup_user(data, count); memdup_user 678 sound/isa/sb/sb16_csp.c kbuf = memdup_user(buf, size); memdup_user 194 sound/isa/wavefront/wavefront_fx.c page_data = memdup_user((unsigned char __user *) memdup_user 1675 sound/isa/wavefront/wavefront_synth.c wc = memdup_user(argp, sizeof(*wc)); memdup_user 2548 sound/pci/emu10k1/emufx.c icode = memdup_user(argp, sizeof(*icode)); memdup_user 2555 sound/pci/emu10k1/emufx.c icode = memdup_user(argp, sizeof(*icode)); memdup_user 2566 sound/pci/emu10k1/emufx.c ipcm = memdup_user(argp, sizeof(*ipcm)); memdup_user 2573 sound/pci/emu10k1/emufx.c ipcm = memdup_user(argp, sizeof(*ipcm)); memdup_user 619 sound/usb/line6/driver.c data_copy = memdup_user(data, count); memdup_user 195 sound/usb/usx2y/usX2Yhwdep.c buf = memdup_user(dsp->image, dsp->length); memdup_user 2945 virt/kvm/kvm_main.c kvm_regs = memdup_user(argp, sizeof(*kvm_regs)); memdup_user 2970 virt/kvm/kvm_main.c kvm_sregs = memdup_user(argp, sizeof(*kvm_sregs)); memdup_user 3062 virt/kvm/kvm_main.c fpu = memdup_user(argp, sizeof(*fpu));