Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit eeac8cda authored by Dan Carpenter's avatar Dan Carpenter Committed by Martin K. Petersen
Browse files

scsi: cxlflash: return -EFAULT if copy_from_user() fails 



The copy_from/to_user() functions return the number of bytes remaining
to be copied but we had intended to return -EFAULT here.

Fixes: bc88ac47 ("scsi: cxlflash: Support AFU debug")
Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Acked-by: default avatarMatthew R. Ochs <mrochs@linux.vnet.ibm.com>
Signed-off-by: default avatarMartin K. Petersen <martin.petersen@oracle.com>
parent c57ec8fb

drivers/scsi/cxlflash/main.c

+7 −4
Original line number Diff line number Diff line
@@ -3401,11 +3401,12 @@ static int cxlflash_afu_debug(struct cxlflash_cfg *cfg, 
		if (is_write) {

			req_flags |= SISL_REQ_FLAGS_HOST_WRITE;



			rc = copy_from_user(kbuf, ubuf, ulen);

			if (unlikely(rc))

			if (copy_from_user(kbuf, ubuf, ulen)) {

				rc = -EFAULT;

				goto out;

			}

		}

	}



	memset(&rcb, 0, sizeof(rcb));

	memset(&asa, 0, sizeof(asa));
@@ -3431,8 +3432,10 @@ static int cxlflash_afu_debug(struct cxlflash_cfg *cfg, 
		goto out;

	}



	if (ulen && !is_write)

		rc = copy_to_user(ubuf, kbuf, ulen);

	if (ulen && !is_write) {

		if (copy_to_user(ubuf, kbuf, ulen))

			rc = -EFAULT;

	}

out:

	kfree(buf);

	dev_dbg(dev, "%s: returning rc=%d\n", __func__, rc);