Bug 188811 - Function lstcon_group_info() returns an improper value when the call to copy_to_user() fails
Summary: Function lstcon_group_info() returns an improper value when the call to copy_...
Status: RESOLVED CODE_FIX
Alias: None
Product: Drivers
Classification: Unclassified
Component: Staging (show other bugs)
Hardware: All Linux
: P1 normal
Assignee: drivers_staging@kernel-bugs.osdl.org
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2016-11-25 11:00 UTC by bianpan
Modified: 2017-05-11 23:57 UTC (History)
1 user (show)

See Also:
Kernel Version: linux-4.9-rc6
Subsystem:
Regression: No
Bisected commit-id:


Attachments
The patch fixes the bug (897 bytes, patch)
2017-05-11 23:57 UTC, bianpan
Details | Diff

Description bianpan 2016-11-25 11:00:29 UTC
Function copy_to_user() returns number of bytes that could not be copied, and a non-zero return value often means errors. In function lstcon_group_info() defined in file drivers/staging/lustre/lnet/selftest/console.c, however, 0 (indicates success) may be returned even when copy_to_user() returns a non-zero value. Maybe the author intends to return "rc" instead of "0" at line 823. Codes related to this bug are summarised as follows.

lstcon_group_info @@ drivers/staging/lustre/lnet/selftest/console.c
 779 int
 780 lstcon_group_info(char *name, lstcon_ndlist_ent_t __user *gents_p,
 781           int *index_p, int *count_p,
 782           lstcon_node_ent_t __user *dents_up)
 783 {
 784     lstcon_ndlist_ent_t *gentp;
 785     struct lstcon_group *grp;
 786     struct lstcon_ndlink *ndl;
 787     int rc;
 788 
 789     rc = lstcon_group_find(name, &grp);
 790     if (rc) {
 791         CDEBUG(D_NET, "Can't find group %s\n", name);
 792         return rc;
 793     }

         ...
 816     rc = copy_to_user(gents_p, gentp,
 817               sizeof(lstcon_ndlist_ent_t)) ? -EFAULT : 0;
 818 
 819     LIBCFS_FREE(gentp, sizeof(lstcon_ndlist_ent_t));
 820 
 821     lstcon_group_decref(grp);
 822  
 823     return 0;      // return rc?
 824 }

Thanks very much!
Comment 1 Jason Lu 2017-01-13 03:53:16 UTC
I think this is fixed in the latest kernel sources.
Comment 2 bianpan 2017-05-11 23:57:22 UTC
Created attachment 256423 [details]
The patch fixes the bug

The patch has been merged into the latest version of the Linux kernel. So I will close the bug.

Note You need to log in before you can comment on or make changes to this bug.