| From c3330d43c7c6b9bc2a90b5974b5e23676e76a3f2 Mon Sep 17 00:00:00 2001 |
| From: Sasha Levin <sashal@kernel.org> |
| Date: Wed, 3 Mar 2021 13:59:12 +0300 |
| Subject: rsxx: Return -EFAULT if copy_to_user() fails |
| |
| From: Dan Carpenter <dan.carpenter@oracle.com> |
| |
| [ Upstream commit 77516d25f54912a7baedeeac1b1b828b6f285152 ] |
| |
| The copy_to_user() function returns the number of bytes remaining but |
| we want to return -EFAULT to the user if it can't complete the copy. |
| The "st" variable only holds zero on success or negative error codes on |
| failure so the type should be int. |
| |
| Fixes: 36f988e978f8 ("rsxx: Adding in debugfs entries.") |
| Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> |
| Signed-off-by: Jens Axboe <axboe@kernel.dk> |
| Signed-off-by: Sasha Levin <sashal@kernel.org> |
| --- |
| drivers/block/rsxx/core.c | 8 +++++--- |
| 1 file changed, 5 insertions(+), 3 deletions(-) |
| |
| diff --git a/drivers/block/rsxx/core.c b/drivers/block/rsxx/core.c |
| index 6beafaa335c7..97b678c0ea13 100644 |
| --- a/drivers/block/rsxx/core.c |
| +++ b/drivers/block/rsxx/core.c |
| @@ -180,15 +180,17 @@ static ssize_t rsxx_cram_read(struct file *fp, char __user *ubuf, |
| { |
| struct rsxx_cardinfo *card = file_inode(fp)->i_private; |
| char *buf; |
| - ssize_t st; |
| + int st; |
| |
| buf = kzalloc(cnt, GFP_KERNEL); |
| if (!buf) |
| return -ENOMEM; |
| |
| st = rsxx_creg_read(card, CREG_ADD_CRAM + (u32)*ppos, cnt, buf, 1); |
| - if (!st) |
| - st = copy_to_user(ubuf, buf, cnt); |
| + if (!st) { |
| + if (copy_to_user(ubuf, buf, cnt)) |
| + st = -EFAULT; |
| + } |
| kfree(buf); |
| if (st) |
| return st; |
| -- |
| 2.30.1 |
| |
