Skip to contentSkip to conversation

isdn/kcapi: return -EFAULT on copy_from_user errors

PATCH Applied Dan Carpenter 3 participants 4 messages Jun 3, 2010

Subsystems (3)
Networking Network drivers Kernel janitors
lore
Share & tools
lore

Dan Carpenter

author
#0 lore raw

PATCH 1/1 isdn/kcapi: return -EFAULT on copy_from_user errors

copy_from_user() returns the number of bytes remaining but we should return -EFAULT here. The error code gets returned to the user. Both old_capi_manufacturer() and capi20_manufacturer() had other places that already returned -EFAULT so this won't break anything.

Signed-off-by Dan Carpenter <[email protected]>
drivers/isdn/capi/kcapi.c +3 -3
index bde3c88..b054494 100644
@@ -1020,12 +1020,12 @@ static int old_capi_manufacturer(unsigned int cmd, void __user *data)
 		if (cmd = AVMB1_ADDCARD) {
 		   if ((retval = copy_from_user(&cdef, data,
 					    sizeof(avmb1_carddef))))
-			   return retval;
+			   return -EFAULT;
 		   cdef.cardtype = AVM_CARDTYPE_B1;
 		} else {
 		   if ((retval = copy_from_user(&cdef, data,
 					    sizeof(avmb1_extcarddef))))
-			   return retval;
+			   return -EFAULT;
 		}
 		cparams.port = cdef.port;
 		cparams.irq = cdef.irq;

@@ -1218,7 +1218,7 @@ int capi20_manufacturer(unsigned int cmd, void __user *data)
 		kcapi_carddef cdef;
 
 		if ((retval = copy_from_user(&cdef, data, sizeof(cdef))))
-			return retval;
+			return -EFAULT;
 
 		cparams.port = cdef.port;
 		cparams.irq = cdef.irq;
#1 lore raw
Quoted 5 lines · Dan Carpenter

copy_from_user() returns the number of bytes remaining but we should return -EFAULT here. The error code gets returned to the user. Both old_capi_manufacturer() and capi20_manufacturer() had other places that already returned -EFAULT so this won't break anything.

Good point.

Quoted 22 lines
Signed-off-by Dan Carpenter <[email protected]>
drivers/isdn/capi/kcapi.c +2 -2
index bde3c88..b054494 100644
@@ -1020,12 +1020,12 @@ static int old_capi_manufacturer(unsigned int cmd, void __user *data)
 		if (cmd == AVMB1_ADDCARD) {
 		   if ((retval = copy_from_user(&cdef, data,
 					    sizeof(avmb1_carddef))))
-			   return retval;
+			   return -EFAULT;
 		   cdef.cardtype = AVM_CARDTYPE_B1;
 		} else {
 		   if ((retval = copy_from_user(&cdef, data,
 					    sizeof(avmb1_extcarddef))))
-			   return retval;
+			   return -EFAULT;
 		}
 		cparams.port = cdef.port;
 		cparams.irq = cdef.irq;

drivers/isdn/capi/kcapi.c int capi20_manufacturer(unsigned int cmd, void __user *data) · line 1224

Quoted 8 lines
drivers/isdn/capi/kcapi.c +1 -1
@@ -1218,7 +1218,7 @@ int capi20_manufacturer(unsigned int cmd, void __user *data)
 		kcapi_carddef cdef;
 
 		if ((retval = copy_from_user(&cdef, data, sizeof(cdef))))
-			return retval;
+			return -EFAULT;
 
 		cparams.port = cdef.port;
 		cparams.irq = cdef.irq;

No need to assign retval anymore, it is overwritten in all non-error cases.

Jan

maintainer
#2 lore raw

From: Jan Kiszka <[email protected]>
Date: Thu, 03 Jun 2010 12:26:42 +0200

Quoted 1 line

No need to assign retval anymore, it is overwritten in all non-error cases.

I'm still going to apply this fix as-is since it's easier to validate and provably won't introduce new compiler warnings.

maintainer Applied
#3 lore raw
In reply to Dan Carpenter

From: Dan Carpenter <[email protected]>
Date: Thu, 3 Jun 2010 11:56:13 +0200

Quoted 6 lines

copy_from_user() returns the number of bytes remaining but we should return -EFAULT here. The error code gets returned to the user. Both old_capi_manufacturer() and capi20_manufacturer() had other places that already returned -EFAULT so this won't break anything.

Signed-off-by Dan Carpenter <[email protected]>

Applied.