If there is a failure during copy_from_user or user-provided data
buffer is invalid, rtw_debugfs_copy_from_user should return negative
error code instead of a positive value count.
Fix this bug by returning correct error code. Moreover, the check
of buffer against null is removed since it will be handled by
copy_from_user.
Signed-off-by: Zhang Shurong <[email protected]>
---
drivers/net/wireless/realtek/rtw88/debug.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/net/wireless/realtek/rtw88/debug.c b/drivers/net/wireless/realtek/rtw88/debug.c
index fa3d73b333ba..3da477e1ebd3 100644
--- a/drivers/net/wireless/realtek/rtw88/debug.c
+++ b/drivers/net/wireless/realtek/rtw88/debug.c
@@ -183,8 +183,8 @@ static int rtw_debugfs_copy_from_user(char tmp[], int size,
tmp_len = (count > size - 1 ? size - 1 : count);
- if (!buffer || copy_from_user(tmp, buffer, tmp_len))
- return count;
+ if (copy_from_user(tmp, buffer, tmp_len))
+ return -EFAULT;
tmp[tmp_len] = '\0';
--
2.40.0
> -----Original Message-----
> From: Zhang Shurong <[email protected]>
> Sent: Thursday, April 27, 2023 1:02 AM
> To: Ping-Ke Shih <[email protected]>
> Cc: [email protected]; [email protected]; [email protected]; [email protected]; [email protected];
> [email protected]; [email protected]; [email protected]; [email protected];
> Zhang Shurong <[email protected]>
> Subject: [PATCH v3 1/2] wifi: rtw88: fix incorrect error codes in rtw_debugfs_copy_from_user
>
> If there is a failure during copy_from_user or user-provided data
> buffer is invalid, rtw_debugfs_copy_from_user should return negative
> error code instead of a positive value count.
>
> Fix this bug by returning correct error code. Moreover, the check
> of buffer against null is removed since it will be handled by
> copy_from_user.
>
> Signed-off-by: Zhang Shurong <[email protected]>
Reviewed-by: Ping-Ke Shih <[email protected]>
[...]
Zhang Shurong <[email protected]> wrote:
> If there is a failure during copy_from_user or user-provided data
> buffer is invalid, rtw_debugfs_copy_from_user should return negative
> error code instead of a positive value count.
>
> Fix this bug by returning correct error code. Moreover, the check
> of buffer against null is removed since it will be handled by
> copy_from_user.
>
> Signed-off-by: Zhang Shurong <[email protected]>
> Reviewed-by: Ping-Ke Shih <[email protected]>
2 patches applied to wireless-next.git, thanks.
225622256b1b wifi: rtw88: fix incorrect error codes in rtw_debugfs_copy_from_user
770055337772 wifi: rtw88: fix incorrect error codes in rtw_debugfs_set_*
--
https://patchwork.kernel.org/project/linux-wireless/patch/[email protected]/
https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches