* [patch] vmwgfx: return an -EFAULT if copy_to_user() fails
@ 2012-11-12 11:07 ` Dan Carpenter
0 siblings, 0 replies; 4+ messages in thread
From: Dan Carpenter @ 2012-11-12 11:07 UTC (permalink / raw)
To: David Airlie
Cc: kernel-janitors, Thomas Hellstrom, dri-devel, Dave Airlie, Thomas Meyer
copy_to_user() returns the number of bytes remaining to be copied, but
we want to return a negative error code here. I fixed a couple of these
last year, but I missed this one.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
---
I think there were only three copy_to/from_user() functions in this
file and they're all fixed now.
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_ioctl.c b/drivers/gpu/drm/vmwgfx/vmwgfx_ioctl.c
index b07ca2e..7290811 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_ioctl.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_ioctl.c
@@ -110,6 +110,8 @@ int vmw_get_cap_3d_ioctl(struct drm_device *dev, void *data,
memcpy_fromio(bounce, &fifo_mem[SVGA_FIFO_3D_CAPS], size);
ret = copy_to_user(buffer, bounce, size);
+ if (ret)
+ ret = -EFAULT;
vfree(bounce);
if (unlikely(ret != 0))
^ permalink raw reply related [flat|nested] 4+ messages in thread
* [patch] vmwgfx: return an -EFAULT if copy_to_user() fails
@ 2012-11-12 11:07 ` Dan Carpenter
0 siblings, 0 replies; 4+ messages in thread
From: Dan Carpenter @ 2012-11-12 11:07 UTC (permalink / raw)
To: David Airlie
Cc: kernel-janitors, Thomas Hellstrom, dri-devel, Dave Airlie, Thomas Meyer
copy_to_user() returns the number of bytes remaining to be copied, but
we want to return a negative error code here. I fixed a couple of these
last year, but I missed this one.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
---
I think there were only three copy_to/from_user() functions in this
file and they're all fixed now.
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_ioctl.c b/drivers/gpu/drm/vmwgfx/vmwgfx_ioctl.c
index b07ca2e..7290811 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_ioctl.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_ioctl.c
@@ -110,6 +110,8 @@ int vmw_get_cap_3d_ioctl(struct drm_device *dev, void *data,
memcpy_fromio(bounce, &fifo_mem[SVGA_FIFO_3D_CAPS], size);
ret = copy_to_user(buffer, bounce, size);
+ if (ret)
+ ret = -EFAULT;
vfree(bounce);
if (unlikely(ret != 0))
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [patch] vmwgfx: return an -EFAULT if copy_to_user() fails
2012-11-12 11:07 ` Dan Carpenter
@ 2012-11-13 20:57 ` Thomas Hellstrom
-1 siblings, 0 replies; 4+ messages in thread
From: Thomas Hellstrom @ 2012-11-13 20:57 UTC (permalink / raw)
To: Dan Carpenter; +Cc: kernel-janitors, dri-devel, Dave Airlie, Thomas Meyer
On 11/12/2012 12:07 PM, Dan Carpenter wrote:
> copy_to_user() returns the number of bytes remaining to be copied, but
> we want to return a negative error code here. I fixed a couple of these
> last year, but I missed this one.
>
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
> ---
> I think there were only three copy_to/from_user() functions in this
> file and they're all fixed now.
>
> diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_ioctl.c b/drivers/gpu/drm/vmwgfx/vmwgfx_ioctl.c
> index b07ca2e..7290811 100644
> --- a/drivers/gpu/drm/vmwgfx/vmwgfx_ioctl.c
> +++ b/drivers/gpu/drm/vmwgfx/vmwgfx_ioctl.c
> @@ -110,6 +110,8 @@ int vmw_get_cap_3d_ioctl(struct drm_device *dev, void *data,
> memcpy_fromio(bounce, &fifo_mem[SVGA_FIFO_3D_CAPS], size);
>
> ret = copy_to_user(buffer, bounce, size);
> + if (ret)
> + ret = -EFAULT;
> vfree(bounce);
>
> if (unlikely(ret != 0))
Reviewed-by: Thomas Hellstrom <thellstrom@vmware.com>
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [patch] vmwgfx: return an -EFAULT if copy_to_user() fails
@ 2012-11-13 20:57 ` Thomas Hellstrom
0 siblings, 0 replies; 4+ messages in thread
From: Thomas Hellstrom @ 2012-11-13 20:57 UTC (permalink / raw)
To: Dan Carpenter; +Cc: kernel-janitors, dri-devel, Dave Airlie, Thomas Meyer
On 11/12/2012 12:07 PM, Dan Carpenter wrote:
> copy_to_user() returns the number of bytes remaining to be copied, but
> we want to return a negative error code here. I fixed a couple of these
> last year, but I missed this one.
>
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
> ---
> I think there were only three copy_to/from_user() functions in this
> file and they're all fixed now.
>
> diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_ioctl.c b/drivers/gpu/drm/vmwgfx/vmwgfx_ioctl.c
> index b07ca2e..7290811 100644
> --- a/drivers/gpu/drm/vmwgfx/vmwgfx_ioctl.c
> +++ b/drivers/gpu/drm/vmwgfx/vmwgfx_ioctl.c
> @@ -110,6 +110,8 @@ int vmw_get_cap_3d_ioctl(struct drm_device *dev, void *data,
> memcpy_fromio(bounce, &fifo_mem[SVGA_FIFO_3D_CAPS], size);
>
> ret = copy_to_user(buffer, bounce, size);
> + if (ret)
> + ret = -EFAULT;
> vfree(bounce);
>
> if (unlikely(ret != 0))
Reviewed-by: Thomas Hellstrom <thellstrom@vmware.com>
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2012-11-13 20:57 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2012-11-12 11:07 [patch] vmwgfx: return an -EFAULT if copy_to_user() fails Dan Carpenter
2012-11-12 11:07 ` Dan Carpenter
2012-11-13 20:57 ` Thomas Hellstrom
2012-11-13 20:57 ` Thomas Hellstrom
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.