| From 332a5b446b7916d272c2a659a3b20909ce34d2c1 Mon Sep 17 00:00:00 2001 |
| From: Lars-Peter Clausen <lars@metafoo.de> |
| Date: Wed, 30 Mar 2016 13:49:14 +0200 |
| Subject: usb: gadget: f_fs: Fix EFAULT generation for async read operations |
| |
| From: Lars-Peter Clausen <lars@metafoo.de> |
| |
| commit 332a5b446b7916d272c2a659a3b20909ce34d2c1 upstream. |
| |
| In the current implementation functionfs generates a EFAULT for async read |
| operations if the read buffer size is larger than the URB data size. Since |
| a application does not necessarily know how much data the host side is |
| going to send it typically supplies a buffer larger than the actual data, |
| which will then result in a EFAULT error. |
| |
| This behaviour was introduced while refactoring the code to use iov_iter |
| interface in commit c993c39b8639 ("gadget/function/f_fs.c: use put iov_iter |
| into io_data"). The original code took the minimum over the URB size and |
| the user buffer size and then attempted to copy that many bytes using |
| copy_to_user(). If copy_to_user() could not copy all data a EFAULT error |
| was generated. Restore the original behaviour by only generating a EFAULT |
| error when the number of bytes copied is not the size of the URB and the |
| target buffer has not been fully filled. |
| |
| Commit 342f39a6c8d3 ("usb: gadget: f_fs: fix check in read operation") |
| already fixed the same problem for the synchronous read path. |
| |
| Fixes: c993c39b8639 ("gadget/function/f_fs.c: use put iov_iter into io_data") |
| Acked-by: Michal Nazarewicz <mina86@mina86.com> |
| Signed-off-by: Lars-Peter Clausen <lars@metafoo.de> |
| Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| |
| --- |
| drivers/usb/gadget/function/f_fs.c | 2 +- |
| 1 file changed, 1 insertion(+), 1 deletion(-) |
| |
| --- a/drivers/usb/gadget/function/f_fs.c |
| +++ b/drivers/usb/gadget/function/f_fs.c |
| @@ -651,7 +651,7 @@ static void ffs_user_copy_worker(struct |
| if (io_data->read && ret > 0) { |
| use_mm(io_data->mm); |
| ret = copy_to_iter(io_data->buf, ret, &io_data->data); |
| - if (iov_iter_count(&io_data->data)) |
| + if (ret != io_data->req->actual && iov_iter_count(&io_data->data)) |
| ret = -EFAULT; |
| unuse_mm(io_data->mm); |
| } |
