From patchwork Fri Jun 4 10:34:40 2010 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Dan Carpenter X-Patchwork-Id: 3602 Return-path: Envelope-to: mchehab@infradead.org Delivery-date: Fri, 04 Jun 2010 10:35:10 +0000 Received: from bombadil.infradead.org [18.85.46.34] by pedra with IMAP (fetchmail-6.3.17) for (single-drop); Fri, 04 Jun 2010 11:14:42 -0300 (BRT) Received: from vger.kernel.org ([209.132.180.67]) by bombadil.infradead.org with esmtp (Exim 4.69 #1 (Red Hat Linux)) id 1OKUF4-0007CO-56; Fri, 04 Jun 2010 10:35:10 +0000 Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753801Ab0FDKfH (ORCPT + 1 other); Fri, 4 Jun 2010 06:35:07 -0400 Received: from ey-out-2122.google.com ([74.125.78.27]:27273 "EHLO ey-out-2122.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753784Ab0FDKfE (ORCPT ); Fri, 4 Jun 2010 06:35:04 -0400 Received: by ey-out-2122.google.com with SMTP id 25so94017eya.19 for ; Fri, 04 Jun 2010 03:35:01 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:date:from:to:cc:subject :message-id:mime-version:content-type:content-disposition:user-agent; bh=AdO5UmPM8nUCVI20+kh7sQ/0mLXAWcj3FysxsVM3mbc=; b=dfGc/wv7UmXrhI0G/lEI9xCQpWfZOBgd5G6/GWu2GFFAeQHuR7okJfU6nOMAfUhZ9h Q8TOYT/tULogvc2HY1t5F5k6L0N05DNrO93DcHGgFOjKyTr5Jb5fYcAiByAoJU5Bqh27 6KahktINmF63O3YWL/4Myx+9W6LCD2OdVsT1A= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=date:from:to:cc:subject:message-id:mime-version:content-type :content-disposition:user-agent; b=X/t2OQ/qtvgRaBXZfNbrefeXj4TdW23cIB6AbExxu6gvn6EZ0ptQ8+DjAn5H3kut42 0aMsicZ+Z73OeiBh+2kXCWWsvdxQDW8hteF2qzanHRGBvYppCiWP53ysECVXQRgqGwRb UxFPws+o2u7YKsSsN2dcD+soe1fN2dynwJIGE= Received: by 10.213.10.8 with SMTP id n8mr7601676ebn.41.1275647701452; Fri, 04 Jun 2010 03:35:01 -0700 (PDT) Received: from bicker ([205.177.176.130]) by mx.google.com with ESMTPS id 13sm634346ewy.5.2010.06.04.03.34.54 (version=TLSv1/SSLv3 cipher=RC4-MD5); Fri, 04 Jun 2010 03:35:00 -0700 (PDT) Date: Fri, 4 Jun 2010 12:34:40 +0200 From: Dan Carpenter To: Mauro Carvalho Chehab Cc: Eduardo Valentin , Hans Verkuil , linux-media@vger.kernel.org, kernel-janitors@vger.kernel.org Subject: [patch] media/radio: fix copy_to_user to user handling Message-ID: <20100604103440.GB5483@bicker> MIME-Version: 1.0 Content-Disposition: inline User-Agent: Mutt/1.5.18 (2008-05-17) Sender: linux-media-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-media@vger.kernel.org copy_to/from_user() returns the number of bytes remaining to be copied but the code here was testing for negative returns. I modified it to return -EFAULT. These functions are called from si4713_s_ext_ctrls() and that only tests for negative error codes. Signed-off-by: Dan Carpenter --- To unsubscribe from this list: send the line "unsubscribe linux-media" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html diff --git a/drivers/media/radio/si4713-i2c.c b/drivers/media/radio/si4713-i2c.c index ab63dd5..fc7f4b7 100644 --- a/drivers/media/radio/si4713-i2c.c +++ b/drivers/media/radio/si4713-i2c.c @@ -1009,8 +1009,10 @@ static int si4713_write_econtrol_string(struct si4713_device *sdev, goto exit; } rval = copy_from_user(ps_name, control->string, len); - if (rval < 0) + if (rval) { + rval = -EFAULT; goto exit; + } ps_name[len] = '\0'; if (strlen(ps_name) % vqc.step) { @@ -1031,8 +1033,10 @@ static int si4713_write_econtrol_string(struct si4713_device *sdev, goto exit; } rval = copy_from_user(radio_text, control->string, len); - if (rval < 0) + if (rval) { + rval = -EFAULT; goto exit; + } radio_text[len] = '\0'; if (strlen(radio_text) % vqc.step) { @@ -1367,6 +1371,8 @@ static int si4713_read_econtrol_string(struct si4713_device *sdev, } rval = copy_to_user(control->string, sdev->rds_info.ps_name, strlen(sdev->rds_info.ps_name) + 1); + if (rval) + rval = -EFAULT; break; case V4L2_CID_RDS_TX_RADIO_TEXT: @@ -1377,6 +1383,8 @@ static int si4713_read_econtrol_string(struct si4713_device *sdev, } rval = copy_to_user(control->string, sdev->rds_info.radio_text, strlen(sdev->rds_info.radio_text) + 1); + if (rval) + rval = -EFAULT; break; default: