Skip to contentSkip to conversation

copy_{to|from}_user checks in ide-tape

PATCH New Felipe W Damasio 1 participant 1 message Oct 6, 2003

lore
Share & tools
lore
#0 lore raw

PATCH 1/1 copy_{to|from}_user checks in ide-tape

Hi Gadi,

(unchecked values found by smatch).

Patch against 2.6-test6.

idetape_copy_stage_{from|to}_user assume that copy_{from|to}_user
will always return 0, which seems wrong.

*But* I'm not sure if the copy fails we should "return" or "continue"
to try again. This patch follows the former approach.

In either case, if we fail and give up at some point, there's no way
to return the error code, since these functions return void. I don't know squad about this driver, but I think this kind of "assumes everything will turn out OK" API is wrong.

Please consider applying and let me know if you want to re-implement
the copy_stage functions to return a OK/Non-OK value.

Cheers,

Felipe

drivers/ide/ide-tape.c renamed from drivers/ide/ide-tape.c.orig +4 -2
@@ -3026,7 +3026,8 @@
 		}
 #endif /* IDETAPE_DEBUG_BUGS */
 		count = min((unsigned int)(bh->b_size - atomic_read(&bh->b_count)), (unsigned int)n);
-		copy_from_user(bh->b_data + atomic_read(&bh->b_count), buf, count);
+		if (copy_from_user(bh->b_data + atomic_read(&bh->b_count), buf, count))
+			return;
 		n -= count;
 		atomic_add(count, &bh->b_count);
 		buf += count;
@@ -3053,7 +3054,8 @@
 		}
 #endif /* IDETAPE_DEBUG_BUGS */
 		count = min(tape->b_count, n);
-		copy_to_user(buf, tape->b_data, count);
+		if (copy_to_user(buf, tape->b_data, count))
+			return;
 		n -= count;
 		tape->b_data += count;
 		tape->b_count -= count;