Message-Id: <200409230226.i8N2QWiF004303@ccure.user-mode-linux.org>
To: akpm@osdl.org
cc: linux-kernel@vger.kernel.org, blaisorblade_spam@yahoo.it
Subject: [PATCH] UML - Don't trash return value
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Date: Wed, 22 Sep 2004 22:26:32 -0400
From: Jeff Dike <jdike@addtoit.com>
Sender: linux-kernel-owner@vger.kernel.org
Content-Length: 1575
Lines: 37

From: Doug Dumitru <doug@easyco.com>
I have been fighting a buffering error when sending large amounts of 
data out pty devices from UML.  I have tried a couple of patches that 
did not really fix the problem (and were rightly rejected by the group), 
but have finally found the real bug.

In /arch/um/drivers/line.c there is a function "buffer_data" that is 
responsible for storing data into the lines ring buffer.  The function 
is "supposed" to return the number of characters actually buffered. 
Unfortunately, in the case where the buffer wraps, the "len" variable is 
decremented by "end" before it is used as the return parameter.

Signed-off-by: Paolo 'Blaisorblade' Giarrusso <blaisorblade_spam@yahoo.it>
Signed-off-by: Jeff Dike <jdike@addtoit.com>

Index: linux-2.6.9-rc2-mm1-orig/arch/um/drivers/line.c
===================================================================
--- linux-2.6.9-rc2-mm1-orig.orig/arch/um/drivers/line.c	2004-09-22 20:39:58.000000000 -0400
+++ linux-2.6.9-rc2-mm1-orig/arch/um/drivers/line.c	2004-09-22 20:55:34.000000000 -0400
@@ -73,9 +73,8 @@
 	else {
 		memcpy(line->tail, buf, end);
 		buf += end;
-		len -= end;
-		memcpy(line->buffer, buf, len);
-		line->tail = line->buffer + len;
+		memcpy(line->buffer, buf, len - end);
+		line->tail = line->buffer + len - end;
 	}
 
 	return(len);

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/