Re: [PATCH] Check copy_*_user return value in

[Paulo Andre']

This is a MIME-formatted message.  If you see this text it means that your
E-mail software does not support MIME-formatted messages.

--=_courier-17663-1053881886-0001-2
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit

On Sun, 25 May 2003 18:28:44 +0200
Jens Axboe <[e-mail]> wrote:

> 
> See above, we've already done access_ok() on the buffer so the
> "unchecked" copy_to/from_user are done that way on purpose. I suppose
> it could be made more explicit with __copy_to/from_user().

Ok, makes sense indeed. Please consider the following patch then.

		Paulo

--=_courier-17663-1053881886-0001-2
Content-Type: text/plain; name="patch-scsi_ioctl.c.diff"; charset=iso-8859-1
Content-Transfer-Encoding: 7bit
Content-disposition: attachment; filename=patch-scsi_ioctl.c.diff

--- scsi_ioctl.c.orig	2003-05-25 16:42:22.000000000 +0100
+++ scsi_ioctl.c	2003-05-25 17:54:21.000000000 +0100
@@ -213,7 +213,7 @@
 
 			nr_sectors = bytes >> 9;
 			if (writing)
-				copy_from_user(buffer,hdr.dxferp,hdr.dxfer_len);
+				__copy_from_user(buffer,hdr.dxferp,hdr.dxfer_len);
 			else
 				memset(buffer, 0, hdr.dxfer_len);
 		}
@@ -225,7 +225,7 @@
 	 * fill in request structure
 	 */
 	rq->cmd_len = hdr.cmd_len;
-	copy_from_user(rq->cmd, hdr.cmdp, hdr.cmd_len);
+	__copy_from_user(rq->cmd, hdr.cmdp, hdr.cmd_len);
 	if (sizeof(rq->cmd) != hdr.cmd_len)
 		memset(rq->cmd + hdr.cmd_len, 0, sizeof(rq->cmd) - hdr.cmd_len);
 
@@ -286,11 +286,11 @@
 
 	blk_put_request(rq);
 
-	copy_to_user(uptr, &hdr, sizeof(*uptr));
+	__copy_to_user(uptr, &hdr, sizeof(*uptr));
 
 	if (buffer) {
 		if (reading)
-			copy_to_user(hdr.dxferp, buffer, hdr.dxfer_len);
+			__copy_to_user(hdr.dxferp, buffer, hdr.dxfer_len);
 
 		kfree(buffer);
 	}

--=_courier-17663-1053881886-0001-2--