Messages in this thread | | | Date | Thu, 3 Jun 2010 14:45:36 +0200 | From | Dan Carpenter <> | Subject | Re: [patch v2] fcntl: return -EFAULT if copy_to_user fails |
| |
On Thu, Jun 03, 2010 at 09:16:52PM +0900, Takuya Yoshikawa wrote: > (2010/06/03 20:59), Jens Axboe wrote: >> On 2010-06-03 12:35, Dan Carpenter wrote: >>> copy_to_user() returns the number of bytes remaining, but we want to >>> return -EFAULT. >>> ret = fcntl(fd, F_SETOWN_EX, NULL); >>> With the original code ret would be 8 here. >>> >>> V2: Takuya Yoshikawa pointed out a similar issue in f_getown_ex() >> >> Pretty basic bug, how long has this been there? > > IIUC, from the beginning, when these were introduced. > > And I recently sent similar bug fixes for other parts. >
It was your clear_user() patch which inspired me. I wrote a smatch check to find these. I've pushed the code to the smatch repo. http://repo.or.cz/r/smatch.git
The heuristic I use is that if we return a variable which is the return value of copy_to_user() and it's non-zero then complain. It didn't find the f_getown_ex() because that return value could come from copy_to_user() or it could be -EINVAL.
I'll mess with it a bit and see if I can make it catch the f_getown_ex() bug.
regards, dan carpenter
| |