Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit e1df0068 authored by Dan Carpenter's avatar Dan Carpenter Committed by Doug Ledford
Browse files

IB/hfi1: fix copy_to/from_user() error handling 



copy_to/from_user() returns the number of bytes which we were not able
to copy.  It doesn't return an error code.

Also a couple places had a printk() on error and I removed that because
people can take advantage of it to fill /var/log/messages with spam.

Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Acked-by: default avatarMike Marciniszyn <mike.marciniszyn@intel.com>
Signed-off-by: default avatarDoug Ledford <dledford@redhat.com>
parent aadfc3b2

drivers/staging/rdma/hfi1/diag.c

+15 −16
Original line number Original line Diff line number Diff line
@@ -1012,11 +1012,10 @@ static long hfi1_ioctl(struct file *fp, unsigned int cmd, unsigned long arg) 
		case HFI1_SNOOP_IOCSETLINKSTATE_EXTRA:

		case HFI1_SNOOP_IOCSETLINKSTATE_EXTRA:

			memset(&link_info, 0, sizeof(link_info));

			memset(&link_info, 0, sizeof(link_info));





			ret = copy_from_user(&link_info,

			if (copy_from_user(&link_info,

				(struct hfi1_link_info __user *)arg,

				(struct hfi1_link_info __user *)arg,

				sizeof(link_info));

				sizeof(link_info)))

			if (ret)

				ret = -EFAULT;

				break;





			value = link_info.port_state;

			value = link_info.port_state;

			index = link_info.port_number;

			index = link_info.port_number;
@@ -1080,9 +1079,10 @@ static long hfi1_ioctl(struct file *fp, unsigned int cmd, unsigned long arg) 
		case HFI1_SNOOP_IOCGETLINKSTATE_EXTRA:

		case HFI1_SNOOP_IOCGETLINKSTATE_EXTRA:

			if (cmd == HFI1_SNOOP_IOCGETLINKSTATE_EXTRA) {

			if (cmd == HFI1_SNOOP_IOCGETLINKSTATE_EXTRA) {

				memset(&link_info, 0, sizeof(link_info));

				memset(&link_info, 0, sizeof(link_info));

				ret = copy_from_user(&link_info,

				if (copy_from_user(&link_info,

					(struct hfi1_link_info __user *)arg,

					(struct hfi1_link_info __user *)arg,

					sizeof(link_info));

					sizeof(link_info)))

					ret = -EFAULT;

				index = link_info.port_number;

				index = link_info.port_number;

			} else {

			} else {

				ret = __get_user(index, (int __user *) arg);

				ret = __get_user(index, (int __user *) arg);
@@ -1114,9 +1114,10 @@ static long hfi1_ioctl(struct file *fp, unsigned int cmd, unsigned long arg) 
							ppd->link_speed_active;

							ppd->link_speed_active;

				link_info.link_width_active =

				link_info.link_width_active =

							ppd->link_width_active;

							ppd->link_width_active;

				ret = copy_to_user(

				if (copy_to_user(

					(struct hfi1_link_info __user *)arg,

					(struct hfi1_link_info __user *)arg,

					&link_info, sizeof(link_info));

					&link_info, sizeof(link_info)))

					ret = -EFAULT;

			} else {

			} else {

				ret = __put_user(value, (int __user *)arg);

				ret = __put_user(value, (int __user *)arg);

			}

			}
@@ -1142,10 +1143,9 @@ static long hfi1_ioctl(struct file *fp, unsigned int cmd, unsigned long arg) 
			snoop_dbg("Setting filter");

			snoop_dbg("Setting filter");

			/* just copy command structure */

			/* just copy command structure */

			argp = (unsigned long *)arg;

			argp = (unsigned long *)arg;

			ret = copy_from_user(&filter_cmd, (void __user *)argp,

			if (copy_from_user(&filter_cmd, (void __user *)argp,

					     sizeof(filter_cmd));

					     sizeof(filter_cmd))) {

			if (ret < 0) {

				ret = -EFAULT;

				pr_alert("Error copying filter command\n");

				break;

				break;

			}

			}

			if (filter_cmd.opcode >= HFI1_MAX_FILTERS) {

			if (filter_cmd.opcode >= HFI1_MAX_FILTERS) {
@@ -1167,12 +1167,11 @@ static long hfi1_ioctl(struct file *fp, unsigned int cmd, unsigned long arg) 
				break;

				break;

			}

			}

			/* copy remaining data from userspace */

			/* copy remaining data from userspace */

			ret = copy_from_user((u8 *)filter_value,

			if (copy_from_user((u8 *)filter_value,

					(void __user *)filter_cmd.value_ptr,

					(void __user *)filter_cmd.value_ptr,

					filter_cmd.length);

					filter_cmd.length)) {

			if (ret < 0) {

				kfree(filter_value);

				kfree(filter_value);

				pr_alert("Error copying filter data\n");

				ret = -EFAULT;

				break;

				break;

			}

			}

			/* Drain packets first */

			/* Drain packets first */