arch/powerpc/platforms/powernv/opal-prd.c

242

msg = memdup_user(buf, size);

arch/um/drivers/hostaudio_kern.c

110

kbuf = memdup_user(buffer, count);

arch/x86/kvm/svm/nested.c

1860

ctl = memdup_user(&user_vmcb->control, sizeof(*ctl));

arch/x86/kvm/svm/nested.c

1864

save = memdup_user(&user_vmcb->save, sizeof(*save));

arch/x86/kvm/vmx/tdx.c

2730

init_vm = memdup_user(user_data,

arch/x86/kvm/x86.c

4715

entries = memdup_user(user_msrs->entries, size);

arch/x86/kvm/x86.c

6228

u.lapic = memdup_user(argp, sizeof(*u.lapic));

arch/x86/kvm/x86.c

6430

u.xsave = memdup_user(argp, size);

arch/x86/kvm/x86.c

6478

u.xcrs = memdup_user(argp, sizeof(*u.xcrs));

arch/x86/kvm/x86.c

6638

u.sregs2 = memdup_user(argp, sizeof(struct kvm_sregs2));

arch/x86/kvm/x86.c

7036

bitmap = memdup_user((__user u8*)user_range->bitmap, bitmap_size);

arch/x86/kvm/x86.c

7366

chip = memdup_user(argp, sizeof(*chip));

arch/x86/kvm/x86.c

7390

chip = memdup_user(argp, sizeof(*chip));

arch/x86/kvm/xen.c

1350

page = memdup_user((u8 __user *)blob_addr, PAGE_SIZE);

block/bsg-lib.c

57

job->request = memdup_user(uptr64(hdr->request), hdr->request_len);

block/sed-opal.c

3244

p = memdup_user(arg, _IOC_SIZE(cmd));

drivers/accel/qaic/qaic_data.c

1017

slice_ent = memdup_user(user_data, arg_size);

drivers/block/floppy.c

3093

ptr = memdup_user(param, sizeof(*ptr));

drivers/block/mtip32xx/mtip32xx.c

1722

outbuf = memdup_user(buf + outtotal, taskout);

drivers/block/mtip32xx/mtip32xx.c

1736

inbuf = memdup_user(buf + intotal, taskin);

drivers/cdrom/cdrom.c

3207

s = memdup_user(arg, size);

drivers/char/applicom.c

712

adgl = memdup_user(argp, sizeof(struct st_ram_io));

drivers/char/nvram.c

271

tmp = memdup_user(buf, count);

drivers/crypto/ccp/sev-dev.c

1893

return memdup_user((void __user *)uaddr, len);

drivers/crypto/intel/qat/qat_common/adf_ctl_drv.c

96

cfg_data = memdup_user((void __user *)arg, sizeof(*cfg_data));

drivers/dma-buf/udmabuf.c

499

list = memdup_user((void __user *)(arg + sizeof(head)), lsize);

drivers/firmware/efi/test/efi_test.c

253

data = memdup_user(setvariable.data, setvariable.data_size);

drivers/firmware/efi/test/efi_test.c

550

data = memdup_user((void *)resetsystem.data,

drivers/firmware/efi/test/efi_test.c

73

buf = memdup_user(src, len);

drivers/firmware/tegra/bpmp-debugfs.c

380

databuf = memdup_user(buf, count);

drivers/fwctl/pds/main.c

370

in_payload = memdup_user(u64_to_user_ptr(rpc->in.payload), rpc->in.len);

drivers/gpio/gpio-sloppy-logic-analyzer.c

206

buf = memdup_user(ubuf, count);

drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c

60

syncobj_handles = memdup_user(u64_to_user_ptr(syncobj_handles_array),

drivers/gpu/drm/amd/amdgpu/amdgpu_psp_ta.c

174

ta_bin = memdup_user(&buf[copy_pos], ta_bin_len);

drivers/gpu/drm/amd/amdgpu/amdgpu_psp_ta.c

326

shared_buf = memdup_user(&buf[copy_pos], shared_buf_len);

drivers/gpu/drm/amd/amdgpu/amdgpu_userq_fence.c

489

syncobj_handles = memdup_user(u64_to_user_ptr(args->syncobj_handles),

drivers/gpu/drm/amd/amdgpu/amdgpu_userq_fence.c

510

bo_handles_read = memdup_user(u64_to_user_ptr(args->bo_read_handles),

drivers/gpu/drm/amd/amdgpu/amdgpu_userq_fence.c

533

bo_handles_write = memdup_user(u64_to_user_ptr(args->bo_write_handles),

drivers/gpu/drm/amd/amdgpu/amdgpu_userq_fence.c

683

bo_handles_read = memdup_user(u64_to_user_ptr(wait_info->bo_read_handles),

drivers/gpu/drm/amd/amdgpu/amdgpu_userq_fence.c

689

bo_handles_write = memdup_user(u64_to_user_ptr(wait_info->bo_write_handles),

drivers/gpu/drm/amd/amdgpu/amdgpu_userq_fence.c

697

syncobj_handles = memdup_user(u64_to_user_ptr(wait_info->syncobj_handles),

drivers/gpu/drm/amd/amdgpu/amdgpu_userq_fence.c

705

timeline_handles = memdup_user(u64_to_user_ptr(wait_info->syncobj_timeline_handles),

drivers/gpu/drm/amd/amdgpu/amdgpu_userq_fence.c

712

timeline_points = memdup_user(u64_to_user_ptr(wait_info->syncobj_timeline_points),

drivers/gpu/drm/amd/amdgpu/mes_userqueue.c

318

compute_mqd = memdup_user(u64_to_user_ptr(mqd_user->mqd), mqd_user->mqd_size);

drivers/gpu/drm/amd/amdgpu/mes_userqueue.c

356

mqd_gfx_v11 = memdup_user(u64_to_user_ptr(mqd_user->mqd), mqd_user->mqd_size);

drivers/gpu/drm/amd/amdgpu/mes_userqueue.c

391

mqd_sdma_v11 = memdup_user(u64_to_user_ptr(mqd_user->mqd), mqd_user->mqd_size);

drivers/gpu/drm/amd/amdkfd/kfd_chardev.c

537

minfo.cu_mask.ptr = memdup_user(cu_mask_ptr, cu_mask_size);

drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c

3304

return memdup_user(usr_queue_id_array, array_size);

drivers/gpu/drm/drm_debugfs.c

568

buf = memdup_user(ubuf, len);

drivers/gpu/drm/i915/gem/i915_gem_context.c

2160

state = memdup_user(u64_to_user_ptr(user.image), ce->engine->context_size);

drivers/gpu/drm/i915/gvt/kvmgt.c

1346

data = memdup_user((void __user *)(arg + minsz),

drivers/gpu/drm/imagination/pvr_context.c

76

stream = memdup_user(u64_to_user_ptr(stream_user_ptr), stream_size);

drivers/gpu/drm/imagination/pvr_job.c

93

stream = memdup_user(u64_to_user_ptr(stream_userptr), stream_len);

drivers/gpu/drm/msm/msm_drv.c

483

buf = memdup_user(metadata, metadata_size);

drivers/gpu/drm/virtio/virtgpu_ioctl.c

520

buf = memdup_user(u64_to_user_ptr(rc_blob->cmd),

drivers/gpu/drm/virtio/virtgpu_ioctl.c

596

ctx_set_params = memdup_user(u64_to_user_ptr(args->ctx_set_params),

drivers/hid/hidraw.c

143

buf = memdup_user(buffer, count);

drivers/hv/hv_utils_transport.c

83

inmsg = memdup_user(buf, count);

drivers/i2c/i2c-dev.c

177

tmp = memdup_user(buf, count);

drivers/i2c/i2c-dev.c

266

msgs[i].buf = memdup_user(data_ptrs[i], msgs[i].len);

drivers/infiniband/core/ucma.c

1465

optval = memdup_user(u64_to_user_ptr(cmd.optval),

drivers/infiniband/hw/hfi1/debugfs.c

717

buff = memdup_user(buf, count);

drivers/infiniband/hw/hfi1/debugfs.c

824

buff = memdup_user(buf, count);

drivers/input/joydev.c

454

abspam = memdup_user(argp, len);

drivers/input/joydev.c

488

keypam = memdup_user(argp, len);

drivers/input/misc/uinput.c

543

user_dev = memdup_user(buffer, sizeof(struct uinput_user_dev));

drivers/media/dvb-core/dvb_demux.c

1153

p = memdup_user(buf, count);

drivers/media/rc/lirc_dev.c

314

txbuf = memdup_user(buf, n);

drivers/media/usb/uvc/uvc_ctrl.c

2598

data = memdup_user(xctrl->ptr, size);

drivers/message/fusion/mptctl.c

1251

karg = memdup_user(uarg, data_size);

drivers/misc/fastrpc.c

1322

name = memdup_user(u64_to_user_ptr(init.name), init.namelen);

drivers/misc/vmw_vmci/vmci_host.c

388

dg = memdup_user((void __user *)(uintptr_t)send_info.addr,

drivers/misc/vmw_vmci/vmci_host.c

757

cpt_buf = memdup_user((void __user *)(uintptr_t)set_info.cpt_buf,

drivers/misc/xilinx_sdfec.c

660

ldpc = memdup_user(arg, sizeof(*ldpc));

drivers/mmc/core/block.c

447

idata->buf = memdup_user((void __user *)(unsigned long)

drivers/mtd/mtdchar.c

365

ops.oobbuf = memdup_user(ptr, length);

drivers/net/ethernet/chelsio/cxgb3/cxgb3_main.c

2354

fw_data = memdup_user(useraddr + sizeof(t), t.len);

drivers/net/ethernet/mellanox/mlx5/core/cmd.c

1536

ptr = memdup_user(buf, count);

drivers/net/hamradio/yam.c

950

ym = memdup_user(data, sizeof(struct yamdrv_ioctl_mcs));

drivers/net/netdevsim/dev.c

189

buf = memdup_user(data, count);

drivers/net/tun.c

832

addr = memdup_user(arg + sizeof(uf), alen);

drivers/net/wan/farsync.c

1959

buf = memdup_user(data + sizeof(struct fstioc_write),

drivers/net/wireless/ath/wil6210/debugfs.c

1018

wmi = memdup_user(buf, len);

drivers/net/wireless/ath/wil6210/debugfs.c

981

frame = memdup_user(buf, len);

drivers/net/wireless/silabs/wfx/debug.c

216

buf = memdup_user(user_buf, count);

drivers/net/wireless/silabs/wfx/debug.c

258

request = memdup_user(user_buf, count);

drivers/net/wireless/ti/wlcore/debugfs.c

1132

buf = memdup_user(user_buf, bytes);

drivers/ptp/ptp_chardev.c

359

extoff = memdup_user(arg, sizeof(*extoff));

drivers/ptp/ptp_chardev.c

409

sysoff = memdup_user(arg, sizeof(*sysoff));

drivers/rapidio/rio_cm.c

1843

buf = memdup_user((void __user *)(uintptr_t)msg.msg, msg.size);

drivers/s390/crypto/pkey_api.c

81

return memdup_user(ukey, keylen);

drivers/scsi/aacraid/commctrl.c

532

user_srbcmd = memdup_user(user_srb, fibsize);

drivers/scsi/esas2r/esas2r_ioctl.c

1283

ioctl = memdup_user(arg, sizeof(struct atto_express_ioctl));

drivers/scsi/hpsa.c

6404

buff = memdup_user(iocommand->buf, iocommand->buf_size);

drivers/scsi/hpsa.c

6515

buff[sg_used] = memdup_user(data_ptr, sz);

drivers/scsi/megaraid/megaraid_sas_base.c

8529

ioc = memdup_user(user_ioc, sizeof(struct megasas_iocpacket));

drivers/scsi/qedf/qedf_debugfs.c

225

kern_buf = memdup_user(buffer, 6);

drivers/scsi/smartpqi/smartpqi_init.c

6821

kernel_buffer = memdup_user(iocommand.buf,

drivers/spi/spidev.c

346

return memdup_user(u_ioc, tmp);

drivers/staging/greybus/authentication.c

227

ims_cert = memdup_user(buf, size);

drivers/staging/greybus/authentication.c

243

authenticate = memdup_user(buf, size);

drivers/tty/vt/vt.c

4900

void *font_data __free(kfree) = font.data = memdup_user(op->data, size);

drivers/usb/class/cdc-wdm.c

398

buf = memdup_user(buffer, count);

drivers/usb/core/devio.c

1750

isopkt = memdup_user(iso_frame_desc, isofrmlen);

drivers/usb/gadget/function/f_fs.c

4333

data = memdup_user(buf, len);

drivers/usb/gadget/legacy/inode.c

1829

kbuf = memdup_user(buf, length);

drivers/usb/gadget/legacy/raw_gadget.c

674

data = memdup_user(ptr + sizeof(*io), io->length);

drivers/usb/gadget/legacy/raw_gadget.c

848

desc = memdup_user((void __user *)value, sizeof(*desc));

drivers/usb/misc/iowarrior.c

401

buf = memdup_user(user_buffer, count);

drivers/vfio/cdx/main.c

194

data = memdup_user(arg->data, data_size);

drivers/vfio/fsl-mc/vfio_fsl_mc.c

209

data = memdup_user((void __user *)(arg + minsz),

drivers/vfio/pci/vfio_pci_core.c

1208

data = memdup_user(&arg->data, data_size);

drivers/vfio/platform/vfio_platform_common.c

358

data = memdup_user((void __user *)(arg + minsz),

drivers/virt/acrn/hsm.c

134

vm_param = memdup_user((void __user *)ioctl_param,

drivers/virt/acrn/hsm.c

181

cpu_regs = memdup_user((void __user *)ioctl_param,

drivers/virt/acrn/hsm.c

233

mmiodev = memdup_user((void __user *)ioctl_param,

drivers/virt/acrn/hsm.c

245

mmiodev = memdup_user((void __user *)ioctl_param,

drivers/virt/acrn/hsm.c

257

pcidev = memdup_user((void __user *)ioctl_param,

drivers/virt/acrn/hsm.c

269

pcidev = memdup_user((void __user *)ioctl_param,

drivers/virt/acrn/hsm.c

281

vdev = memdup_user((void __user *)ioctl_param,

drivers/virt/acrn/hsm.c

293

vdev = memdup_user((void __user *)ioctl_param,

drivers/virt/acrn/hsm.c

304

irq_info = memdup_user((void __user *)ioctl_param,

drivers/virt/acrn/hsm.c

316

irq_info = memdup_user((void __user *)ioctl_param,

drivers/virt/acrn/hsm.c

334

msi = memdup_user((void __user *)ioctl_param,

fs/autofs/dev-ioctl.c

95

res = memdup_user(in, tmp.size);

fs/btrfs/ioctl.c

1188

vol_args = memdup_user(arg, sizeof(*vol_args));

fs/btrfs/ioctl.c

1215

vol_args = memdup_user(arg, sizeof(*vol_args));

fs/btrfs/ioctl.c

1237

inherit = memdup_user(vol_args->qgroup_inherit, vol_args->size);

fs/btrfs/ioctl.c

1871

args = memdup_user(argp, sizeof(*args));

fs/btrfs/ioctl.c

1922

args = memdup_user(argp, sizeof(*args));

fs/btrfs/ioctl.c

2085

rootrefs = memdup_user(argp, sizeof(*rootrefs));

fs/btrfs/ioctl.c

2185

vol_args2 = memdup_user(arg, sizeof(*vol_args2));

fs/btrfs/ioctl.c

2281

vol_args = memdup_user(arg, sizeof(*vol_args));

fs/btrfs/ioctl.c

2496

vol_args = memdup_user(arg, sizeof(*vol_args));

fs/btrfs/ioctl.c

2534

vol_args = memdup_user(arg, sizeof(*vol_args));

fs/btrfs/ioctl.c

2602

vol_args = memdup_user(arg, sizeof(*vol_args));

fs/btrfs/ioctl.c

2650

fi_args = memdup_user(arg, sizeof(*fi_args));

fs/btrfs/ioctl.c

2703

di_args = memdup_user(arg, sizeof(*di_args));

fs/btrfs/ioctl.c

3024

sa = memdup_user(arg, sizeof(*sa));

fs/btrfs/ioctl.c

3082

sa = memdup_user(arg, sizeof(*sa));

fs/btrfs/ioctl.c

3101

sa = memdup_user(arg, sizeof(*sa));

fs/btrfs/ioctl.c

3133

p = memdup_user(arg, sizeof(*p));

fs/btrfs/ioctl.c

3189

ipa = memdup_user(arg, sizeof(*ipa));

fs/btrfs/ioctl.c

3242

loi = memdup_user(arg, sizeof(*loi));

fs/btrfs/ioctl.c

3394

bargs = memdup_user(arg, sizeof(*bargs));

fs/btrfs/ioctl.c

3530

sa = memdup_user(arg, sizeof(*sa));

fs/btrfs/ioctl.c

3606

sa = memdup_user(arg, sizeof(*sa));

fs/btrfs/ioctl.c

3677

sa = memdup_user(arg, sizeof(*sa));

fs/btrfs/ioctl.c

3740

sa = memdup_user(arg, sizeof(*sa));

fs/btrfs/ioctl.c

3789

qsa = memdup_user(arg, sizeof(*qsa));

fs/btrfs/ioctl.c

3952

args32 = memdup_user(arg, sizeof(*args32));

fs/btrfs/ioctl.c

4001

sa = memdup_user(arg, sizeof(*sa));

fs/btrfs/ioctl.c

4281

arg = memdup_user(argp, sizeof(*arg));

fs/btrfs/ioctl.c

983

vol_args = memdup_user(arg, sizeof(*vol_args));

fs/btrfs/super.c

2238

vol = memdup_user((void __user *)arg, sizeof(*vol));

fs/ecryptfs/miscdev.c

398

data = memdup_user(buf, count);

fs/efivarfs/file.c

35

data = memdup_user(userbuf + sizeof(attributes), datasize);

fs/ioctl.c

434

same = memdup_user(argp, size);

fs/nfsd/nfs4recover.c

718

namecopy = memdup_user(&ci->cc_name.cn_id, namelen);

fs/nfsd/nfs4recover.c

725

princhashcopy = memdup_user(

fs/nfsd/nfs4recover.c

744

namecopy = memdup_user(&cnm->cn_id, namelen);

fs/proc/base.c

2833

page = memdup_user(buf, count);

fs/smb/client/smb2ops.c

1628

buffer = memdup_user(arg + sizeof(struct smb_query_info), qi.output_buffer_length);

fs/xfs/scrub/scrub.c

929

vectors = memdup_user(uvectors, vec_bytes);

fs/xfs/xfs_handle.c

547

args.value = memdup_user(ubuf, len);

fs/xfs/xfs_handle.c

633

ops = memdup_user(am_hreq.ops, size);

fs/xfs/xfs_ioctl32.c

396

ops = memdup_user(compat_ptr(am_hreq.ops), size);

include/linux/string.h

39

return memdup_user(src, nbytes);

include/rdma/ib_verbs.h

3115

buf = memdup_user(p, len);

io_uring/register.c

125

res = memdup_user(arg, size);

io_uring/register.c

52

p = memdup_user(arg, size);

kernel/kcov.c

748

remote_arg = memdup_user((void __user *)arg, remote_arg_size);

kernel/kexec_file.c

261

image->cmdline_buf = memdup_user(cmdline_ptr, cmdline_len);

mm/util.c

232

EXPORT_SYMBOL(memdup_user);

mm/util.c

280

p = memdup_user(s, length);

net/bluetooth/hidp/core.c

760

session->rd_data = memdup_user(req->rd_data, req->rd_size);

net/bpf/test_run.c

1634

ctx = memdup_user(ctx_in, ctx_size_in);

net/bpf/test_run.c

770

info.ctx = memdup_user(ctx_in, ctx_size_in);

net/ethtool/ioctl.c

2984

data = memdup_user(useraddr, tuna.len);

net/ethtool/ioctl.c

3184

data = memdup_user(useraddr, tuna.len);

net/sctp/socket.c

1418

kaddrs = memdup_user(param.addrs, param.addr_num);

samples/vfio-mdev/mtty.c

1864

ptr = data = memdup_user((void __user *)(arg + minsz),

security/ipe/policy_fs.c

310

copy = memdup_user(data, len);

security/keys/keyctl_pkey.c

244

in = memdup_user(_in, params.in_len);

security/keys/keyctl_pkey.c

306

in = memdup_user(_in, params.in_len);

security/keys/keyctl_pkey.c

312

in2 = memdup_user(_in2, params.in2_len);

security/security.c

3732

lctx = memdup_user(uctx, size);

security/smack/smackfs.c

2542

data = memdup_user(buf, count);

sound/core/compress_offload.c

1114

memdup_user((void __user *)arg, sizeof(*task));

sound/core/compress_offload.c

1176

memdup_user((void __user *)arg, sizeof(*task));

sound/core/compress_offload.c

1268

memdup_user((void __user *)arg, sizeof(*status));

sound/core/compress_offload.c

658

memdup_user((void __user *)arg, sizeof(*params));

sound/core/control.c

1249

memdup_user(_control, sizeof(*control));

sound/core/control.c

1326

memdup_user(_control, sizeof(*control));

sound/core/pcm_native.c

4132

memdup_user(_oparams, sizeof(*oparams));

sound/core/pcm_native.c

4161

memdup_user(_oparams, sizeof(*oparams));

sound/core/pcm_native.c

588

memdup_user(_params, sizeof(*params));

sound/core/pcm_native.c

894

memdup_user(_params, sizeof(*params));

sound/core/seq/seq_clientmgr.c

2125

p = memdup_user(argp->info, size);

sound/core/timer.c

1621

memdup_user(_ginfo, sizeof(*ginfo));

sound/core/timer.c

2197

memdup_user(_utimer_info, sizeof(*utimer_info));

sound/firewire/fireworks/fireworks_hwdep.c

167

buf = memdup_user(data, count);

sound/isa/sb/sb16_csp.c

669

kbuf = memdup_user(buf, size);

sound/isa/wavefront/wavefront_synth.c

1690

wc = memdup_user(argp, sizeof(*wc));

sound/pci/emu10k1/emufx.c

2487

icode = memdup_user(argp, sizeof(*icode));

sound/pci/emu10k1/emufx.c

2494

icode = memdup_user(argp, sizeof(*icode));

sound/pci/emu10k1/emufx.c

2505

ipcm = memdup_user(argp, sizeof(*ipcm));

sound/pci/emu10k1/emufx.c

2512

ipcm = memdup_user(argp, sizeof(*ipcm));

sound/soc/codecs/cros_ec_codec.c

760

buf = memdup_user(bytes, size);

sound/soc/codecs/tas2781-i2c.c

1539

src = memdup_user(from, count);

sound/usb/line6/driver.c

617

data_copy = memdup_user(data, count);

sound/usb/usx2y/usX2Yhwdep.c

180

buf = memdup_user(dsp->image, dsp->length);

virt/kvm/kvm_main.c

4509

kvm_regs = memdup_user(argp, sizeof(*kvm_regs));

virt/kvm/kvm_main.c

4533

kvm_sregs = memdup_user(argp, sizeof(*kvm_sregs));

virt/kvm/kvm_main.c

4625

fpu = memdup_user(argp, sizeof(*fpu));