Skip to contentSkip to conversation

alpha: PTR_ERR overwrites -EINVAL in syscall osf_mount

PATCH In review Roel Kluin 3 participants 3 messages Feb 3, 2010 Alpha port

lore
Share & tools
lore

Roel Kluin

author
#0 lore raw

PATCH 1/1 alpha: PTR_ERR overwrites -EINVAL in syscall osf_mount

The initial -EINVAL value is overwritten by `retval = PTR_ERR(name)'. If this isn't an error pointer and typenr is not 1, 6 or 9, then this retval, a pointer cast to a long, is returned.

Signed-off-by Roel Kluin <[email protected]>

---
Was this intended? Not sure whether this can occur, found by code analysis.

arch/alpha/kernel/osf_sys.c +2 -1
index 62619f2..53c213f 100644
@@ -361,7 +361,7 @@ osf_procfs_mount(char *dirname, struct procfs_args __user *args, int flags)
 SYSCALL_DEFINE4(osf_mount, unsigned long, typenr, char __user *, path,
 		int, flag, void __user *, data)
 {
-	int retval = -EINVAL;
+	int retval;
 	char *name;
 
 	name = getname(path);

@@ -379,6 +379,7 @@ SYSCALL_DEFINE4(osf_mount, unsigned long, typenr, char __user *, path,
 		retval = osf_procfs_mount(name, data, flag);
 		break;
 	default:
+		retval = -EINVAL;
 		printk("osf_mount(%ld, %x)\n", typenr, flag);
 	}
 	putname(name);
maintainer
#1 lore raw
Quoted 25 lines · Roel Kluin

The initial -EINVAL value is overwritten by `retval = PTR_ERR(name)'. If this isn't an error pointer and typenr is not 1, 6 or 9, then this retval, a pointer cast to a long, is returned.

Signed-off-by Roel Kluin <[email protected]>

---
Was this intended? Not sure whether this can occur, found by code analysis.

arch/alpha/kernel/osf_sys.c +1 -1
index 62619f2..53c213f 100644
@@ -361,7 +361,7 @@ osf_procfs_mount(char *dirname, struct procfs_args __user *args, int flags)
  SYSCALL_DEFINE4(osf_mount, unsigned long, typenr, char __user *, path,
                int, flag, void __user *, data)
  {
-       int retval = -EINVAL;
+       int retval;
        char *name;
 
        name = getname(path);

@@ -379,6 +379,7 @@ SYSCALL_DEFINE4(osf_mount, unsigned long, typenr, char __user *, path,
                retval = osf_procfs_mount(name, data, flag);
                break;
Quoted 6 lines

       default:
+               retval = -EINVAL; printk("osf_mount(%ld, %x)\n", typenr, flag); }
       putname(name);

Looks like a bug to me as well. Can anyone else confirm?

Matt Turner
--
To unsubscribe from this list: send the line "unsubscribe linux-alpha" in the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html