Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit adc7242e authored by Dan Carpenter's avatar Dan Carpenter Committed by Greg Kroah-Hartman
Browse files

xen/xenbus: fix return type in xenbus_file_read() 



commit 32ad11127b95236dfc52375f3707853194a7f4b4 upstream.

This code tries to store -EFAULT in an unsigned int.  The
xenbus_file_read() function returns type ssize_t so the negative value
is returned as a positive value to the user.

This change forces another change to the min() macro.  Originally, the
min() macro used "unsigned" type which checkpatch complains about.  Also
unsigned type would break if "len" were not capped at MAX_RW_COUNT.  Use
size_t for the min().  (No effect on runtime for the min_t() change).

Fixes: 2fb3683e ("xen: Add xenbus device driver")
Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: default avatarOleksandr Tyshchenko <oleksandr_tyshchenko@epam.com>
Link: https://lore.kernel.org/r/YutxJUaUYRG/VLVc@kili


Signed-off-by: default avatarJuergen Gross <jgross@suse.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 09fc7ffd

drivers/xen/xenbus/xenbus_dev_frontend.c

+2 −2
Original line number Original line Diff line number Diff line
@@ -122,7 +122,7 @@ static ssize_t xenbus_file_read(struct file *filp, 
{

{

	struct xenbus_file_priv *u = filp->private_data;

	struct xenbus_file_priv *u = filp->private_data;

	struct read_buffer *rb;

	struct read_buffer *rb;

	unsigned i;

	ssize_t i;

	int ret;

	int ret;





	mutex_lock(&u->reply_mutex);

	mutex_lock(&u->reply_mutex);
@@ -142,7 +142,7 @@ static ssize_t xenbus_file_read(struct file *filp, 
	rb = list_entry(u->read_buffers.next, struct read_buffer, list);

	rb = list_entry(u->read_buffers.next, struct read_buffer, list);

	i = 0;

	i = 0;

	while (i < len) {

	while (i < len) {

		unsigned sz = min((unsigned)len - i, rb->len - rb->cons);

		size_t sz = min_t(size_t, len - i, rb->len - rb->cons);





		ret = copy_to_user(ubuf + i, &rb->msg[rb->cons], sz);

		ret = copy_to_user(ubuf + i, &rb->msg[rb->cons], sz);