| Message ID | tencent_D2EB102CC7435C0110154E62ECA6A7D67505@qq.com (mailing list archive) |
|---|---|
| State | Accepted |
| Commit | 225622256b1b7156624e281e1c0251c292ea24cd |
| Delegated to: | Kalle Valo |
| Headers | show |
| Series | [v3,1/2] wifi: rtw88: fix incorrect error codes in rtw_debugfs_copy_from_user | expand |
> -----Original Message----- > From: Zhang Shurong <zhang_shurong@foxmail.com> > Sent: Thursday, April 27, 2023 1:02 AM > To: Ping-Ke Shih <pkshih@realtek.com> > Cc: tony0620emma@gmail.com; kvalo@kernel.org; davem@davemloft.net; edumazet@google.com; kuba@kernel.org; > pabeni@redhat.com; linux-wireless@vger.kernel.org; netdev@vger.kernel.org; linux-kernel@vger.kernel.org; > Zhang Shurong <zhang_shurong@foxmail.com> > Subject: [PATCH v3 1/2] wifi: rtw88: fix incorrect error codes in rtw_debugfs_copy_from_user > > If there is a failure during copy_from_user or user-provided data > buffer is invalid, rtw_debugfs_copy_from_user should return negative > error code instead of a positive value count. > > Fix this bug by returning correct error code. Moreover, the check > of buffer against null is removed since it will be handled by > copy_from_user. > > Signed-off-by: Zhang Shurong <zhang_shurong@foxmail.com> Reviewed-by: Ping-Ke Shih <pkshih@realtek.com> [...]
Zhang Shurong <zhang_shurong@foxmail.com> wrote: > If there is a failure during copy_from_user or user-provided data > buffer is invalid, rtw_debugfs_copy_from_user should return negative > error code instead of a positive value count. > > Fix this bug by returning correct error code. Moreover, the check > of buffer against null is removed since it will be handled by > copy_from_user. > > Signed-off-by: Zhang Shurong <zhang_shurong@foxmail.com> > Reviewed-by: Ping-Ke Shih <pkshih@realtek.com> 2 patches applied to wireless-next.git, thanks. 225622256b1b wifi: rtw88: fix incorrect error codes in rtw_debugfs_copy_from_user 770055337772 wifi: rtw88: fix incorrect error codes in rtw_debugfs_set_*
diff --git a/drivers/net/wireless/realtek/rtw88/debug.c b/drivers/net/wireless/realtek/rtw88/debug.c index fa3d73b333ba..3da477e1ebd3 100644 --- a/drivers/net/wireless/realtek/rtw88/debug.c +++ b/drivers/net/wireless/realtek/rtw88/debug.c @@ -183,8 +183,8 @@ static int rtw_debugfs_copy_from_user(char tmp[], int size, tmp_len = (count > size - 1 ? size - 1 : count); - if (!buffer || copy_from_user(tmp, buffer, tmp_len)) - return count; + if (copy_from_user(tmp, buffer, tmp_len)) + return -EFAULT; tmp[tmp_len] = '\0';
If there is a failure during copy_from_user or user-provided data buffer is invalid, rtw_debugfs_copy_from_user should return negative error code instead of a positive value count. Fix this bug by returning correct error code. Moreover, the check of buffer against null is removed since it will be handled by copy_from_user. Signed-off-by: Zhang Shurong <zhang_shurong@foxmail.com> --- drivers/net/wireless/realtek/rtw88/debug.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)