Commit e1df0068 authored by Dan Carpenter's avatar Dan Carpenter Committed by Doug Ledford

IB/hfi1: fix copy_to/from_user() error handling

copy_to/from_user() returns the number of bytes which we were not able
to copy.  It doesn't return an error code.

Also a couple places had a printk() on error and I removed that because
people can take advantage of it to fill /var/log/messages with spam.
Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Acked-by: default avatarMike Marciniszyn <mike.marciniszyn@intel.com>
Signed-off-by: default avatarDoug Ledford <dledford@redhat.com>
parent aadfc3b2
...@@ -1012,11 +1012,10 @@ static long hfi1_ioctl(struct file *fp, unsigned int cmd, unsigned long arg) ...@@ -1012,11 +1012,10 @@ static long hfi1_ioctl(struct file *fp, unsigned int cmd, unsigned long arg)
case HFI1_SNOOP_IOCSETLINKSTATE_EXTRA: case HFI1_SNOOP_IOCSETLINKSTATE_EXTRA:
memset(&link_info, 0, sizeof(link_info)); memset(&link_info, 0, sizeof(link_info));
ret = copy_from_user(&link_info, if (copy_from_user(&link_info,
(struct hfi1_link_info __user *)arg, (struct hfi1_link_info __user *)arg,
sizeof(link_info)); sizeof(link_info)))
if (ret) ret = -EFAULT;
break;
value = link_info.port_state; value = link_info.port_state;
index = link_info.port_number; index = link_info.port_number;
...@@ -1080,9 +1079,10 @@ static long hfi1_ioctl(struct file *fp, unsigned int cmd, unsigned long arg) ...@@ -1080,9 +1079,10 @@ static long hfi1_ioctl(struct file *fp, unsigned int cmd, unsigned long arg)
case HFI1_SNOOP_IOCGETLINKSTATE_EXTRA: case HFI1_SNOOP_IOCGETLINKSTATE_EXTRA:
if (cmd == HFI1_SNOOP_IOCGETLINKSTATE_EXTRA) { if (cmd == HFI1_SNOOP_IOCGETLINKSTATE_EXTRA) {
memset(&link_info, 0, sizeof(link_info)); memset(&link_info, 0, sizeof(link_info));
ret = copy_from_user(&link_info, if (copy_from_user(&link_info,
(struct hfi1_link_info __user *)arg, (struct hfi1_link_info __user *)arg,
sizeof(link_info)); sizeof(link_info)))
ret = -EFAULT;
index = link_info.port_number; index = link_info.port_number;
} else { } else {
ret = __get_user(index, (int __user *) arg); ret = __get_user(index, (int __user *) arg);
...@@ -1114,9 +1114,10 @@ static long hfi1_ioctl(struct file *fp, unsigned int cmd, unsigned long arg) ...@@ -1114,9 +1114,10 @@ static long hfi1_ioctl(struct file *fp, unsigned int cmd, unsigned long arg)
ppd->link_speed_active; ppd->link_speed_active;
link_info.link_width_active = link_info.link_width_active =
ppd->link_width_active; ppd->link_width_active;
ret = copy_to_user( if (copy_to_user(
(struct hfi1_link_info __user *)arg, (struct hfi1_link_info __user *)arg,
&link_info, sizeof(link_info)); &link_info, sizeof(link_info)))
ret = -EFAULT;
} else { } else {
ret = __put_user(value, (int __user *)arg); ret = __put_user(value, (int __user *)arg);
} }
...@@ -1142,10 +1143,9 @@ static long hfi1_ioctl(struct file *fp, unsigned int cmd, unsigned long arg) ...@@ -1142,10 +1143,9 @@ static long hfi1_ioctl(struct file *fp, unsigned int cmd, unsigned long arg)
snoop_dbg("Setting filter"); snoop_dbg("Setting filter");
/* just copy command structure */ /* just copy command structure */
argp = (unsigned long *)arg; argp = (unsigned long *)arg;
ret = copy_from_user(&filter_cmd, (void __user *)argp, if (copy_from_user(&filter_cmd, (void __user *)argp,
sizeof(filter_cmd)); sizeof(filter_cmd))) {
if (ret < 0) { ret = -EFAULT;
pr_alert("Error copying filter command\n");
break; break;
} }
if (filter_cmd.opcode >= HFI1_MAX_FILTERS) { if (filter_cmd.opcode >= HFI1_MAX_FILTERS) {
...@@ -1167,12 +1167,11 @@ static long hfi1_ioctl(struct file *fp, unsigned int cmd, unsigned long arg) ...@@ -1167,12 +1167,11 @@ static long hfi1_ioctl(struct file *fp, unsigned int cmd, unsigned long arg)
break; break;
} }
/* copy remaining data from userspace */ /* copy remaining data from userspace */
ret = copy_from_user((u8 *)filter_value, if (copy_from_user((u8 *)filter_value,
(void __user *)filter_cmd.value_ptr, (void __user *)filter_cmd.value_ptr,
filter_cmd.length); filter_cmd.length)) {
if (ret < 0) {
kfree(filter_value); kfree(filter_value);
pr_alert("Error copying filter data\n"); ret = -EFAULT;
break; break;
} }
/* Drain packets first */ /* Drain packets first */
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment