__copy_to_user() returns the number of bytes remaining to be copied but
we want to return a negative error code here.
Signed-off-by: Dan Carpenter <dan.carpenter at oracle.com>
diff --git a/drivers/xen/privcmd.c b/drivers/xen/privcmd.c
index fdff8f9..0ce006a 100644
--- a/drivers/xen/privcmd.c
+++ b/drivers/xen/privcmd.c
@@ -393,8 +393,11 @@ static long privcmd_ioctl_mmap_batch(void __user *udata,
int version)
state.err = err_array;
ret = traverse_pages(m.num, sizeof(xen_pfn_t),
&pagelist, mmap_return_errors_v1, &state);
- } else if (version == 2)
+ } else if (version == 2) {
ret = __copy_to_user(m.err, err_array, m.num * sizeof(int));
+ if (ret)
+ ret = -EFAULT;
+ }
/* If we have not had any EFAULT-like global errors then set the global
* error to -ENOENT if necessary. */
Andres Lagar-Cavilla
2012-Sep-09 19:49 UTC
[patch 2/3] xen/privcmd: return -EFAULT on error
On Sep 8, 2012, at 5:57 AM, Dan Carpenter wrote:> __copy_to_user() returns the number of bytes remaining to be copied but > we want to return a negative error code here. > > Signed-off-by: Dan Carpenter <dan.carpenter at oracle.com>Acked-by: Andres Lagar-Cavilla <andres at lagarcavilla.org>> > diff --git a/drivers/xen/privcmd.c b/drivers/xen/privcmd.c > index fdff8f9..0ce006a 100644 > --- a/drivers/xen/privcmd.c > +++ b/drivers/xen/privcmd.c > @@ -393,8 +393,11 @@ static long privcmd_ioctl_mmap_batch(void __user *udata, int version) > state.err = err_array; > ret = traverse_pages(m.num, sizeof(xen_pfn_t), > &pagelist, mmap_return_errors_v1, &state); > - } else if (version == 2) > + } else if (version == 2) { > ret = __copy_to_user(m.err, err_array, m.num * sizeof(int)); > + if (ret) > + ret = -EFAULT; > + } > > /* If we have not had any EFAULT-like global errors then set the global > * error to -ENOENT if necessary. */