提交 3f91bd42 编写于 作者: S Sam Ravnborg 提交者: David S. Miller

can: Fix copy_from_user() results interpretation

Both copy_to_ and _from_user return the number of bytes, that failed to
reach their destination, not the 0/-EXXX values.

Based on patch from Pavel Emelyanov <xemul@openvz.org>
Signed-off-by: NSam Ravnborg <sam@ravnborg.org>
Acked-by: NOliver Hartkopp <oliver.hartkopp@volkswagen.de>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>
上级 5c5d6dab
......@@ -435,15 +435,13 @@ static int raw_setsockopt(struct socket *sock, int level, int optname,
if (!filter)
return -ENOMEM;
err = copy_from_user(filter, optval, optlen);
if (err) {
if (copy_from_user(filter, optval, optlen)) {
kfree(filter);
return err;
return -EFAULT;
}
} else if (count == 1) {
err = copy_from_user(&sfilter, optval, optlen);
if (err)
return err;
if (copy_from_user(&sfilter, optval, optlen))
return -EFAULT;
}
lock_sock(sk);
......@@ -493,9 +491,8 @@ static int raw_setsockopt(struct socket *sock, int level, int optname,
if (optlen != sizeof(err_mask))
return -EINVAL;
err = copy_from_user(&err_mask, optval, optlen);
if (err)
return err;
if (copy_from_user(&err_mask, optval, optlen))
return -EFAULT;
err_mask &= CAN_ERR_MASK;
......@@ -531,7 +528,8 @@ static int raw_setsockopt(struct socket *sock, int level, int optname,
if (optlen != sizeof(ro->loopback))
return -EINVAL;
err = copy_from_user(&ro->loopback, optval, optlen);
if (copy_from_user(&ro->loopback, optval, optlen))
return -EFAULT;
break;
......@@ -539,7 +537,8 @@ static int raw_setsockopt(struct socket *sock, int level, int optname,
if (optlen != sizeof(ro->recv_own_msgs))
return -EINVAL;
err = copy_from_user(&ro->recv_own_msgs, optval, optlen);
if (copy_from_user(&ro->recv_own_msgs, optval, optlen))
return -EFAULT;
break;
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册