diff options
| author | Dan Carpenter <error27@gmail.com> | 2010-06-03 12:35:42 +0200 |
|---|---|---|
| committer | Al Viro <viro@zeniv.linux.org.uk> | 2010-06-04 23:16:28 +0200 |
| commit | 5b54470daded19d83ea2bbf5f6bc12662942cd63 (patch) | |
| tree | 93ac73e7eba1231c863903cd814d12f4cb935b1e /fs/fcntl.c | |
| parent | wrong type for 'magic' argument in simple_fill_super() (diff) | |
| download | linux-5b54470daded19d83ea2bbf5f6bc12662942cd63.tar.xz linux-5b54470daded19d83ea2bbf5f6bc12662942cd63.zip | |
fcntl: return -EFAULT if copy_to_user fails
copy_to_user() returns the number of bytes remaining, but we want to
return -EFAULT.
ret = fcntl(fd, F_SETOWN_EX, NULL);
With the original code ret would be 8 here.
V2: Takuya Yoshikawa pointed out a similar issue in f_getown_ex()
Signed-off-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Diffstat (limited to 'fs/fcntl.c')
| -rw-r--r-- | fs/fcntl.c | 7 |
1 files changed, 5 insertions, 2 deletions
diff --git a/fs/fcntl.c b/fs/fcntl.c index f74d270ba155..51e11bf5708f 100644 --- a/fs/fcntl.c +++ b/fs/fcntl.c @@ -274,7 +274,7 @@ static int f_setown_ex(struct file *filp, unsigned long arg) ret = copy_from_user(&owner, owner_p, sizeof(owner)); if (ret) - return ret; + return -EFAULT; switch (owner.type) { case F_OWNER_TID: @@ -332,8 +332,11 @@ static int f_getown_ex(struct file *filp, unsigned long arg) } read_unlock(&filp->f_owner.lock); - if (!ret) + if (!ret) { ret = copy_to_user(owner_p, &owner, sizeof(owner)); + if (ret) + ret = -EFAULT; + } return ret; } |