Commit fe9b081b authored by David S. Miller's avatar David S. Miller

[SPARC64]: Fix off-by-one handling of size in user_fixup.c

Noticed by Jurij Smakov <jurij@wooyd.org>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 190bd54f
...@@ -20,11 +20,12 @@ unsigned long copy_from_user_fixup(void *to, const void __user *from, unsigned l ...@@ -20,11 +20,12 @@ unsigned long copy_from_user_fixup(void *to, const void __user *from, unsigned l
char *dst = to; char *dst = to;
const char __user *src = from; const char __user *src = from;
while (size--) { while (size) {
if (__get_user(*dst, src)) if (__get_user(*dst, src))
break; break;
dst++; dst++;
src++; src++;
size--;
} }
if (size) if (size)
...@@ -38,11 +39,12 @@ unsigned long copy_to_user_fixup(void __user *to, const void *from, unsigned lon ...@@ -38,11 +39,12 @@ unsigned long copy_to_user_fixup(void __user *to, const void *from, unsigned lon
char __user *dst = to; char __user *dst = to;
const char *src = from; const char *src = from;
while (size--) { while (size) {
if (__put_user(*src, dst)) if (__put_user(*src, dst))
break; break;
dst++; dst++;
src++; src++;
size--;
} }
return size; return size;
...@@ -53,7 +55,7 @@ unsigned long copy_in_user_fixup(void __user *to, void __user *from, unsigned lo ...@@ -53,7 +55,7 @@ unsigned long copy_in_user_fixup(void __user *to, void __user *from, unsigned lo
char __user *dst = to; char __user *dst = to;
char __user *src = from; char __user *src = from;
while (size--) { while (size) {
char tmp; char tmp;
if (__get_user(tmp, src)) if (__get_user(tmp, src))
...@@ -62,6 +64,7 @@ unsigned long copy_in_user_fixup(void __user *to, void __user *from, unsigned lo ...@@ -62,6 +64,7 @@ unsigned long copy_in_user_fixup(void __user *to, void __user *from, unsigned lo
break; break;
dst++; dst++;
src++; src++;
size--;
} }
return size; return size;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment