[lkml]   [2010]   [Jun]   [3]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    SubjectRe: [patch v2] fcntl: return -EFAULT if copy_to_user fails
    On Thu, Jun 03, 2010 at 09:16:52PM +0900, Takuya Yoshikawa wrote:
    > (2010/06/03 20:59), Jens Axboe wrote:
    >> On 2010-06-03 12:35, Dan Carpenter wrote:
    >>> copy_to_user() returns the number of bytes remaining, but we want to
    >>> return -EFAULT.
    >>> ret = fcntl(fd, F_SETOWN_EX, NULL);
    >>> With the original code ret would be 8 here.
    >>> V2: Takuya Yoshikawa pointed out a similar issue in f_getown_ex()
    >> Pretty basic bug, how long has this been there?
    > IIUC, from the beginning, when these were introduced.
    > And I recently sent similar bug fixes for other parts.

    It was your clear_user() patch which inspired me. I wrote a smatch
    check to find these. I've pushed the code to the smatch repo.

    The heuristic I use is that if we return a variable which is the
    return value of copy_to_user() and it's non-zero then complain. It
    didn't find the f_getown_ex() because that return value could come from
    copy_to_user() or it could be -EINVAL.

    I'll mess with it a bit and see if I can make it catch the f_getown_ex()

    dan carpenter

     \ /
      Last update: 2010-06-03 14:49    [W:0.021 / U:73.852 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site