net: Fix wrong interpretation of some copy_to_user() results.
I found some places, that erroneously return the value obtained from the copy_to_user() call: if some amount of bytes were not able to get to the user (this is what this one returns) the proper behavior is to return the -EFAULT error, not that number itself. Signed-off-by: Pavel Emelyanov <xemul@openvz.org> Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
parent
cc93d7d77d
commit
653252c230
|
@ -573,7 +573,8 @@ static int raw_getsockopt(struct socket *sock, int level, int optname,
|
|||
int fsize = ro->count * sizeof(struct can_filter);
|
||||
if (len > fsize)
|
||||
len = fsize;
|
||||
err = copy_to_user(optval, ro->filter, len);
|
||||
if (copy_to_user(optval, ro->filter, len))
|
||||
err = -EFAULT;
|
||||
} else
|
||||
len = 0;
|
||||
release_sock(sk);
|
||||
|
|
|
@ -140,7 +140,7 @@ static ssize_t dccpprobe_read(struct file *file, char __user *buf,
|
|||
goto out_free;
|
||||
|
||||
cnt = kfifo_get(dccpw.fifo, tbuf, len);
|
||||
error = copy_to_user(buf, tbuf, cnt);
|
||||
error = copy_to_user(buf, tbuf, cnt) ? -EFAULT : 0;
|
||||
|
||||
out_free:
|
||||
vfree(tbuf);
|
||||
|
|
|
@ -1756,8 +1756,8 @@ static int getsockopt(struct socket *sock,
|
|||
else if (len < sizeof(value)) {
|
||||
res = -EINVAL;
|
||||
}
|
||||
else if ((res = copy_to_user(ov, &value, sizeof(value)))) {
|
||||
/* couldn't return value */
|
||||
else if (copy_to_user(ov, &value, sizeof(value))) {
|
||||
res = -EFAULT;
|
||||
}
|
||||
else {
|
||||
res = put_user(sizeof(value), ol);
|
||||
|
|
Loading…
Reference in New Issue