Don't access a user buffer directly from the kernel.

[jhb]

Summary

The handle_string callback for the ENCIOC_SETSTRING ioctl was passing a
user pointer to memcpy(). Fix by using copyin() instead.

For ENCIOC_GETSTRING ioctls, the handler was storing the user pointer
in a CCB's data_ptr field where it was indirected by other code. Fix
this by allocating a temporary buffer (which ENCIOC_SETSTRING already
did) and copying the result out to the user buffer after the CCB has
been processed.

Test Plan

• compile tested only

[jhb]

This was found by CheriBSD where user and kernel pointers are different types so generate compile errors, but SMAP should have caught this one at runtime I think.

[jrtc27]

sys/cam/scsi/scsi_enc_ses.c

2909 ↗

(On Diff #70744)

You need to free buf on this error path.

[kib]

Modulo the free() note.