Commit 653252c2 authored by Pavel Emelyanov's avatar Pavel Emelyanov Committed by David S. Miller
Browse files

net: Fix wrong interpretation of some copy_to_user() results. 



I found some places, that erroneously return the value obtained from
the copy_to_user() call: if some amount of bytes were not able to get
to the user (this is what this one returns) the proper behavior is to
return the -EFAULT error, not that number itself.

Signed-off-by: default avatarPavel Emelyanov <xemul@openvz.org>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent cc93d7d7

net/can/raw.c

+2 −1
Original line number Diff line number Diff line
@@ -573,7 +573,8 @@ static int raw_getsockopt(struct socket *sock, int level, int optname, 
			int fsize = ro->count * sizeof(struct can_filter);

			if (len > fsize)

				len = fsize;

			err = copy_to_user(optval, ro->filter, len);

			if (copy_to_user(optval, ro->filter, len))

				err = -EFAULT;

		} else

			len = 0;

		release_sock(sk);

net/dccp/probe.c

+1 −1
Original line number Diff line number Diff line
@@ -140,7 +140,7 @@ static ssize_t dccpprobe_read(struct file *file, char __user *buf, 
		goto out_free;



	cnt = kfifo_get(dccpw.fifo, tbuf, len);

	error = copy_to_user(buf, tbuf, cnt);

	error = copy_to_user(buf, tbuf, cnt) ? -EFAULT : 0;



out_free:

	vfree(tbuf);

net/tipc/socket.c

+2 −2
Original line number Diff line number Diff line
@@ -1756,8 +1756,8 @@ static int getsockopt(struct socket *sock, 
	else if (len < sizeof(value)) {

		res = -EINVAL;

	}

	else if ((res = copy_to_user(ov, &value, sizeof(value)))) {

		/* couldn't return value */

	else if (copy_to_user(ov, &value, sizeof(value))) {

		res = -EFAULT;

	}

	else {

		res = put_user(sizeof(value), ol);

CRA Git | Maintained and supported by SUSTech CRA and CCSE