diff mbox

[1/3] vfio-mdev: return -EFAULT if copy_to_user() fails

Message ID 20170107062749.GA26959@elgon.mountain (mailing list archive)
State New, archived
Headers show

Commit Message

Dan Carpenter Jan. 7, 2017, 6:27 a.m. UTC
The copy_to_user() function returns the number of bytes which it wasn't
able to copy but we want to return a negative error code.

Fixes: 9d1a546c53b4 ("docs: Sample driver to demonstrate how to use Mediated device framework.")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>

--
To unsubscribe from this list: send the line "unsubscribe kvm" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Comments

Kirti Wankhede Jan. 9, 2017, 6:37 p.m. UTC | #1
CC+= Alex to pull this change.

Reviewed by: Kirti Wankhede <kwankhede@nvidia.com>

Thanks,
Kirti

On 1/7/2017 11:57 AM, Dan Carpenter wrote:
> The copy_to_user() function returns the number of bytes which it wasn't
> able to copy but we want to return a negative error code.
> 
> Fixes: 9d1a546c53b4 ("docs: Sample driver to demonstrate how to use Mediated device framework.")
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
> 
> diff --git a/samples/vfio-mdev/mtty.c b/samples/vfio-mdev/mtty.c
> index 919c10d5b12e..d2656ff569c1 100644
> --- a/samples/vfio-mdev/mtty.c
> +++ b/samples/vfio-mdev/mtty.c
> @@ -1180,7 +1180,10 @@ static long mtty_ioctl(struct mdev_device *mdev, unsigned int cmd,
>  
>  		memcpy(&mdev_state->dev_info, &info, sizeof(info));
>  
> -		return copy_to_user((void __user *)arg, &info, minsz);
> +		if (copy_to_user((void __user *)arg, &info, minsz))
> +			return -EFAULT;
> +
> +		return 0;
>  	}
>  	case VFIO_DEVICE_GET_REGION_INFO:
>  	{
> @@ -1201,7 +1204,10 @@ static long mtty_ioctl(struct mdev_device *mdev, unsigned int cmd,
>  		if (ret)
>  			return ret;
>  
> -		return copy_to_user((void __user *)arg, &info, minsz);
> +		if (copy_to_user((void __user *)arg, &info, minsz))
> +			return -EFAULT;
> +
> +		return 0;
>  	}
>  
>  	case VFIO_DEVICE_GET_IRQ_INFO:
> @@ -1224,7 +1230,10 @@ static long mtty_ioctl(struct mdev_device *mdev, unsigned int cmd,
>  		if (info.count == -1)
>  			return -EINVAL;
>  
> -		return copy_to_user((void __user *)arg, &info, minsz);
> +		if (copy_to_user((void __user *)arg, &info, minsz))
> +			return -EFAULT;
> +
> +		return 0;
>  	}
>  	case VFIO_DEVICE_SET_IRQS:
>  	{
> 
--
To unsubscribe from this list: send the line "unsubscribe kvm" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Alex Williamson Jan. 11, 2017, 7:15 p.m. UTC | #2
On Tue, 10 Jan 2017 00:07:23 +0530
Kirti Wankhede <kwankhede@nvidia.com> wrote:

> CC+= Alex to pull this change.
> 
> Reviewed by: Kirti Wankhede <kwankhede@nvidia.com>

Thanks Dan.  Applied all three to for-linus for v4.10 with Kirti's R-b.
Thanks,

Alex

> On 1/7/2017 11:57 AM, Dan Carpenter wrote:
> > The copy_to_user() function returns the number of bytes which it wasn't
> > able to copy but we want to return a negative error code.
> > 
> > Fixes: 9d1a546c53b4 ("docs: Sample driver to demonstrate how to use Mediated device framework.")
> > Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
> > 
> > diff --git a/samples/vfio-mdev/mtty.c b/samples/vfio-mdev/mtty.c
> > index 919c10d5b12e..d2656ff569c1 100644
> > --- a/samples/vfio-mdev/mtty.c
> > +++ b/samples/vfio-mdev/mtty.c
> > @@ -1180,7 +1180,10 @@ static long mtty_ioctl(struct mdev_device *mdev, unsigned int cmd,
> >  
> >  		memcpy(&mdev_state->dev_info, &info, sizeof(info));
> >  
> > -		return copy_to_user((void __user *)arg, &info, minsz);
> > +		if (copy_to_user((void __user *)arg, &info, minsz))
> > +			return -EFAULT;
> > +
> > +		return 0;
> >  	}
> >  	case VFIO_DEVICE_GET_REGION_INFO:
> >  	{
> > @@ -1201,7 +1204,10 @@ static long mtty_ioctl(struct mdev_device *mdev, unsigned int cmd,
> >  		if (ret)
> >  			return ret;
> >  
> > -		return copy_to_user((void __user *)arg, &info, minsz);
> > +		if (copy_to_user((void __user *)arg, &info, minsz))
> > +			return -EFAULT;
> > +
> > +		return 0;
> >  	}
> >  
> >  	case VFIO_DEVICE_GET_IRQ_INFO:
> > @@ -1224,7 +1230,10 @@ static long mtty_ioctl(struct mdev_device *mdev, unsigned int cmd,
> >  		if (info.count == -1)
> >  			return -EINVAL;
> >  
> > -		return copy_to_user((void __user *)arg, &info, minsz);
> > +		if (copy_to_user((void __user *)arg, &info, minsz))
> > +			return -EFAULT;
> > +
> > +		return 0;
> >  	}
> >  	case VFIO_DEVICE_SET_IRQS:
> >  	{
> >   
> --
> To unsubscribe from this list: send the line "unsubscribe kvm" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html

--
To unsubscribe from this list: send the line "unsubscribe kvm" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
diff mbox

Patch

diff --git a/samples/vfio-mdev/mtty.c b/samples/vfio-mdev/mtty.c
index 919c10d5b12e..d2656ff569c1 100644
--- a/samples/vfio-mdev/mtty.c
+++ b/samples/vfio-mdev/mtty.c
@@ -1180,7 +1180,10 @@  static long mtty_ioctl(struct mdev_device *mdev, unsigned int cmd,
 
 		memcpy(&mdev_state->dev_info, &info, sizeof(info));
 
-		return copy_to_user((void __user *)arg, &info, minsz);
+		if (copy_to_user((void __user *)arg, &info, minsz))
+			return -EFAULT;
+
+		return 0;
 	}
 	case VFIO_DEVICE_GET_REGION_INFO:
 	{
@@ -1201,7 +1204,10 @@  static long mtty_ioctl(struct mdev_device *mdev, unsigned int cmd,
 		if (ret)
 			return ret;
 
-		return copy_to_user((void __user *)arg, &info, minsz);
+		if (copy_to_user((void __user *)arg, &info, minsz))
+			return -EFAULT;
+
+		return 0;
 	}
 
 	case VFIO_DEVICE_GET_IRQ_INFO:
@@ -1224,7 +1230,10 @@  static long mtty_ioctl(struct mdev_device *mdev, unsigned int cmd,
 		if (info.count == -1)
 			return -EINVAL;
 
-		return copy_to_user((void __user *)arg, &info, minsz);
+		if (copy_to_user((void __user *)arg, &info, minsz))
+			return -EFAULT;
+
+		return 0;
 	}
 	case VFIO_DEVICE_SET_IRQS:
 	{