2007-10-26 17:32:06

by Chuck Lever III

Subject: [PATCH 09/27] SUNRPC: Fix use of copy_to_user() in gss_pipe_upcall()

The gss_pipe_upcall() function expects the copy_to_user() function to
return a negative error value if the call fails, but copy_to_user()
returns an unsigned long number of bytes that couldn't be copied.

Signed-off-by: Chuck Lever <[email protected]>
---

net/sunrpc/auth_gss/auth_gss.c | 13 +++++++------
1 files changed, 7 insertions(+), 6 deletions(-)

diff --git a/net/sunrpc/auth_gss/auth_gss.c b/net/sunrpc/auth_gss/auth_gss.c
index 53995af..f9e546c 100644
--- a/net/sunrpc/auth_gss/auth_gss.c
+++ b/net/sunrpc/auth_gss/auth_gss.c
@@ -472,18 +472,19 @@ gss_pipe_upcall(struct file *filp, struct rpc_pipe_msg *msg,
char __user *dst, size_t buflen)
{
char *data = (char *)msg->data + msg->copied;
- ssize_t mlen = msg->len;
- ssize_t left;
+ size_t mlen = msg->len;
+ unsigned long left;

if (mlen > buflen)
mlen = buflen;
left = copy_to_user(dst, data, mlen);
- if (left < 0) {
- msg->errno = left;
- return left;
+ if (left == mlen) {
+ msg->errno = -EFAULT;
+ return -1;
}
+
mlen -= left;
- msg->copied += mlen;
+ msg->copied += left;
msg->errno = 0;
return mlen;
}


-------------------------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems? Stop.
Now Search log events and configuration files using AJAX and a browser.
Download your FREE copy of Splunk now >> http://get.splunk.com/
_______________________________________________
NFS maillist - [email protected]
https://lists.sourceforge.net/lists/listinfo/nfs

2007-10-26 18:33:11

by Trond Myklebust

Subject: Re: [PATCH 09/27] SUNRPC: Fix use of copy_to_user() in gss_pipe_upcall()

On Fri, 2007-10-26 at 13:31 -0400, Chuck Lever wrote:
> The gss_pipe_upcall() function expects the copy_to_user() function to
> return a negative error value if the call fails, but copy_to_user()
> returns an unsigned long number of bytes that couldn't be copied.
>
> Signed-off-by: Chuck Lever <[email protected]>
> ---
>
> net/sunrpc/auth_gss/auth_gss.c | 13 +++++++------
> 1 files changed, 7 insertions(+), 6 deletions(-)
>
> diff --git a/net/sunrpc/auth_gss/auth_gss.c b/net/sunrpc/auth_gss/auth_gss.c
> index 53995af..f9e546c 100644
> --- a/net/sunrpc/auth_gss/auth_gss.c
> +++ b/net/sunrpc/auth_gss/auth_gss.c
> @@ -472,18 +472,19 @@ gss_pipe_upcall(struct file *filp, struct rpc_pipe_msg *msg,
> char __user *dst, size_t buflen)
> {
> char *data = (char *)msg->data + msg->copied;
> - ssize_t mlen = msg->len;
> - ssize_t left;
> + size_t mlen = msg->len;
> + unsigned long left;
>
> if (mlen > buflen)
> mlen = buflen;
> left = copy_to_user(dst, data, mlen);
> - if (left < 0) {
> - msg->errno = left;
> - return left;
> + if (left == mlen) {
> + msg->errno = -EFAULT;
> + return -1;

NACK. This will end up returning -1 as the errno to a user read()
request.

Trond



-------------------------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems? Stop.
Now Search log events and configuration files using AJAX and a browser.
Download your FREE copy of Splunk now >> http://get.splunk.com/
_______________________________________________
NFS maillist - [email protected]
https://lists.sourceforge.net/lists/listinfo/nfs