Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux

Input: serio_raw - signal EFAULT even if read/write partially succeeds

When copy_to/from_user fails in the middle of transfer we should not
report to the user that read/write partially succeeded but rather
report -EFAULT right away, so that application will know that it got
its buffers all wrong.

If application messed up its buffers we can't trust the data fetched
from userspace and successfully written to the device or if data read
from the device and transferred to userspace ended up where application
expected it to end.

If serio_write() fails we still going to report partial writes if failure
happens in the middle of the transfer.

This is basically a revert of 7a0a27d2ce38aee19a31fee8c12095f586eed393
and 4fa0771138d0b56fe59ab8ab3b1ce9e594484362.

Signed-off-by: Dmitry Torokhov <dtor@mail.ru>

+18 -15
+18 -15
drivers/input/serio/serio_raw.c
··· 165 165 struct serio_raw *serio_raw = client->serio_raw; 166 166 char uninitialized_var(c); 167 167 ssize_t read = 0; 168 - int error = 0; 168 + int error; 169 169 170 - do { 170 + for (;;) { 171 171 if (serio_raw->dead) 172 172 return -ENODEV; 173 173 ··· 179 179 break; 180 180 181 181 while (read < count && serio_raw_fetch_byte(serio_raw, &c)) { 182 - if (put_user(c, buffer++)) { 183 - error = -EFAULT; 184 - goto out; 185 - } 182 + if (put_user(c, buffer++)) 183 + return -EFAULT; 186 184 read++; 187 185 } 188 186 189 187 if (read) 190 188 break; 191 189 192 - if (!(file->f_flags & O_NONBLOCK)) 190 + if (!(file->f_flags & O_NONBLOCK)) { 193 191 error = wait_event_interruptible(serio_raw->wait, 194 192 serio_raw->head != serio_raw->tail || 195 193 serio_raw->dead); 196 - } while (!error); 194 + if (error) 195 + return error; 196 + } 197 + } 197 198 198 - out: 199 - return read ?: error; 199 + return read; 200 200 } 201 201 202 202 static ssize_t serio_raw_write(struct file *file, const char __user *buffer, ··· 204 204 { 205 205 struct serio_raw_client *client = file->private_data; 206 206 struct serio_raw *serio_raw = client->serio_raw; 207 - ssize_t written = 0; 208 - int retval; 207 + int retval = 0; 209 208 unsigned char c; 210 209 211 210 retval = mutex_lock_interruptible(&serio_raw_mutex); ··· 224 225 retval = -EFAULT; 225 226 goto out; 226 227 } 228 + 227 229 if (serio_write(serio_raw->serio, c)) { 228 - retval = -EIO; 230 + /* Either signal error or partial write */ 231 + if (retval == 0) 232 + retval = -EIO; 229 233 goto out; 230 234 } 231 - written++; 235 + 236 + retval++; 232 237 } 233 238 234 239 out: 235 240 mutex_unlock(&serio_raw_mutex); 236 - return written ?: retval; 241 + return retval; 237 242 } 238 243 239 244 static unsigned int serio_raw_poll(struct file *file, poll_table *wait)