How to pass a char *array (belonging to the user address space) to a tasklet or workqueue in a kernel module?

Question

I’m writing a device driver. If someone calls the write operation I want it to be deferred (using tasklet or workqueue). The code should be something like that:

static ssize_t dev_write(struct file *filp, const char *buff, size_t len, loff_t *off) {

      packed_work *the_task;
      the_task = kzalloc(sizeof(packed_work), GFP_ATOMIC);
      if (the_task == NULL) {
         printk(KERN_ERR "%s: tasklet buffer allocation failure\n", MODNAME);
         return -1;
      }

      the_task->buffer = the_task;
      the_task->buff = buff;
      the_task->len = len;

      INIT_WORK(&(the_task->the_work), (void*)deferred_write);
      schedule_work(&the_task->the_work);

      return len;
}

void deferred_write(struct work_struct *data) {
    
      printk(“the text: %s\n”, container_of(data, packed_work, the_work)->buff);

      //copy_from_user(&(the_object->stream_content), container_of(data, packed_work, the_work)->buff, len);

      kfree((void*)container_of(data,packed_work,the_work));   

}

And the struct looks like this:

typedef struct _packed_work{
    void *buffer;
    const char *buff; 
    size_t len;
    struct work_struct the_work;
} packed_work;

The problem is that the kernel crashes. It crashes even before the copy_from_user (that’s why I commented it). In the deferred_write() I can print the length of the string but not the string itself. Is it a problem because the buffer is in the user space memory?

I know that, as a workaround, I can copy the user buffer in the task struct (using the copy_from_user() in the function write()) and then use the strcpy() in the deferred_write() function. But I really would like to use the copy_from_user() in deferred_write(). Is it possible? What can I do?

Answer 1

Even if it is possible (and there is surely a way), the user process has probably changed the contents of the buffer in the time before deferred_write runs. Notice that user programs often allocate these buffers on the stack, so they get overwritten when the function that called write returns and calls other functions.

Even worse: the user process could have unmapped the buffer, or it could have exited.

So you should not delay reading the buffer. You should read the buffer inside the write call and not anywhere else.