From ec74765d9f592715292b8b33689a6af6db4cf5c5 Mon Sep 17 00:00:00 2001 From: Dan Carpenter Date: Thu, 24 Dec 2015 10:24:37 +0300 Subject: [PATCH] ACPI / debugger: copy_to_user doesn't return errors The copy_to/from_user() functions don't return error codes, they return the number of bytes remaining. We had intended to return -EFUALT here. We actually have already checked access_ok() in an earlier function so I don't think these functions will fail but let's fix it anyway. Signed-off-by: Dan Carpenter Signed-off-by: Rafael J. Wysocki --- drivers/acpi/acpi_dbg.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/drivers/acpi/acpi_dbg.c b/drivers/acpi/acpi_dbg.c index 975ccecf6215..e8d1698c15bb 100644 --- a/drivers/acpi/acpi_dbg.c +++ b/drivers/acpi/acpi_dbg.c @@ -592,9 +592,10 @@ static int acpi_aml_read_user(char __user *buf, int len) smp_rmb(); p = &crc->buf[crc->tail]; n = min(len, circ_count_to_end(crc)); - ret = copy_to_user(buf, p, n); - if (IS_ERR_VALUE(ret)) + if (copy_to_user(buf, p, n)) { + ret = -EFAULT; goto out; + } /* sync tail after removing logs */ smp_mb(); crc->tail = (crc->tail + n) & (ACPI_AML_BUF_SIZE - 1); @@ -661,9 +662,10 @@ static int acpi_aml_write_user(const char __user *buf, int len) smp_mb(); p = &crc->buf[crc->head]; n = min(len, circ_space_to_end(crc)); - ret = copy_from_user(p, buf, n); - if (IS_ERR_VALUE(ret)) + if (copy_from_user(p, buf, n)) { + ret = -EFAULT; goto out; + } /* sync head after inserting cmds */ smp_wmb(); crc->head = (crc->head + n) & (ACPI_AML_BUF_SIZE - 1);