fs: nfs: misused copy_to_user() return value
in [Kernel]
|
Prev: [112/140] KVM: read apic->irr with ioapic lock held
Next: [098/140] USB: ehci-mxc: bail out on transceiver problems
From: Trond Myklebust on 30 Jul 2010 13:50 On Fri, 2010-07-30 at 15:09 +0400, Kulikov Vasiliy wrote: > copy_to_user() returns nonzero value on error, this value may be any > value between 0 and requested count, not only requested count. > > Signed-off-by: Kulikov Vasiliy <segooon(a)gmail.com> > --- > fs/nfs/idmap.c | 2 +- > 1 files changed, 1 insertions(+), 1 deletions(-) > > diff --git a/fs/nfs/idmap.c b/fs/nfs/idmap.c > index 21a84d4..a9f2cd5 100644 > --- a/fs/nfs/idmap.c > +++ b/fs/nfs/idmap.c > @@ -362,7 +362,7 @@ idmap_pipe_upcall(struct file *filp, struct rpc_pipe_msg *msg, > unsigned long left; > > left = copy_to_user(dst, data, mlen); > - if (left == mlen) { > + if (left) > msg->errno = -EFAULT; > return -EFAULT; > } ....and we do handle the case where copy_to_user returns less than the requested number of bytes: it is called a 'short read' and is quite allowed in POSIX. The userland application can just call sys_read() again... Trond -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo(a)vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
From: Vasiliy Kulikov on 30 Jul 2010 14:10
On Fri, Jul 30, 2010 at 13:47 -0400, Trond Myklebust wrote: > On Fri, 2010-07-30 at 15:09 +0400, Kulikov Vasiliy wrote: > > copy_to_user() returns nonzero value on error, this value may be any > > value between 0 and requested count, not only requested count. > > > > Signed-off-by: Kulikov Vasiliy <segooon(a)gmail.com> > > --- > > fs/nfs/idmap.c | 2 +- > > 1 files changed, 1 insertions(+), 1 deletions(-) > > > > diff --git a/fs/nfs/idmap.c b/fs/nfs/idmap.c > > index 21a84d4..a9f2cd5 100644 > > --- a/fs/nfs/idmap.c > > +++ b/fs/nfs/idmap.c > > @@ -362,7 +362,7 @@ idmap_pipe_upcall(struct file *filp, struct rpc_pipe_msg *msg, > > unsigned long left; > > > > left = copy_to_user(dst, data, mlen); > > - if (left == mlen) { > > + if (left) > > msg->errno = -EFAULT; > > return -EFAULT; > > } > > ...and we do handle the case where copy_to_user returns less than the > requested number of bytes: it is called a 'short read' and is quite > allowed in POSIX. The userland application can just call sys_read() > again... Right, please ignore these 2 patches. > > Trond -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo(a)vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/ |