Bug 188811
| Summary: | Function lstcon_group_info() returns an improper value when the call to copy_to_user() fails | ||
|---|---|---|---|
| Product: | Drivers | Reporter: | bianpan (bianpan2010) |
| Component: | Staging | Assignee: | drivers_staging (drivers_staging) |
| Status: | RESOLVED CODE_FIX | ||
| Severity: | normal | CC: | jasonbangbang |
| Priority: | P1 | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Kernel Version: | linux-4.9-rc6 | Subsystem: | |
| Regression: | No | Bisected commit-id: | |
| Attachments: | The patch fixes the bug | ||
I think this is fixed in the latest kernel sources. Created attachment 256423 [details]
The patch fixes the bug
The patch has been merged into the latest version of the Linux kernel. So I will close the bug.
|
Function copy_to_user() returns number of bytes that could not be copied, and a non-zero return value often means errors. In function lstcon_group_info() defined in file drivers/staging/lustre/lnet/selftest/console.c, however, 0 (indicates success) may be returned even when copy_to_user() returns a non-zero value. Maybe the author intends to return "rc" instead of "0" at line 823. Codes related to this bug are summarised as follows. lstcon_group_info @@ drivers/staging/lustre/lnet/selftest/console.c 779 int 780 lstcon_group_info(char *name, lstcon_ndlist_ent_t __user *gents_p, 781 int *index_p, int *count_p, 782 lstcon_node_ent_t __user *dents_up) 783 { 784 lstcon_ndlist_ent_t *gentp; 785 struct lstcon_group *grp; 786 struct lstcon_ndlink *ndl; 787 int rc; 788 789 rc = lstcon_group_find(name, &grp); 790 if (rc) { 791 CDEBUG(D_NET, "Can't find group %s\n", name); 792 return rc; 793 } ... 816 rc = copy_to_user(gents_p, gentp, 817 sizeof(lstcon_ndlist_ent_t)) ? -EFAULT : 0; 818 819 LIBCFS_FREE(gentp, sizeof(lstcon_ndlist_ent_t)); 820 821 lstcon_group_decref(grp); 822 823 return 0; // return rc? 824 } Thanks very much!