Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux

tty: fix up iterate_tty_read() EOVERFLOW handling

When I converted the tty_ldisc_ops 'read()' function to take a kernel
pointer, I was a bit too aggressive about the ldisc returning EOVERFLOW.

Yes, we want to have EOVERFLOW override any partially read data (because
the whole point is that the buffer was too small for the whole packet,
and we don't want to see partial packets), but it shouldn't override a
previous EFAULT.

And in fact, it really is just EOVERFLOW that is special and should
throw away any partially read data, not "any error". Admittedly
EOVERFLOW is currently the only one that can happen for a continuation
read - and if the first read iteration returns an error we won't have this issue.

So this is more of a technicality, but let's just make the intent very
explicit, and re-organize the error handling a bit so that this is all
clearer.

Reported-by: Jiri Slaby <jirislaby@kernel.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Reviewed-by: Jiri Slaby <jirislaby@kernel.org>
Link: https://lore.kernel.org/r/CAHk-=wh+-rGsa=xruEWdg_fJViFG8rN9bpLrfLz=_yBYh2tBhA@mail.gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

authored by

Linus Torvalds and committed by
Greg Kroah-Hartman
e71a8d5c ddc5fda7

+13 -6
+13 -6
drivers/tty/tty_io.c
··· 877 877 if (!size) 878 878 break; 879 879 880 - /* 881 - * A ldisc read error return will override any previously copied 882 - * data (eg -EOVERFLOW from HDLC) 883 - */ 884 880 if (size < 0) { 885 - memzero_explicit(kernel_buf, sizeof(kernel_buf)); 886 - return size; 881 + /* Did we have an earlier error (ie -EFAULT)? */ 882 + if (retval) 883 + break; 884 + retval = size; 885 + 886 + /* 887 + * -EOVERFLOW means we didn't have enough space 888 + * for a whole packet, and we shouldn't return 889 + * a partial result. 890 + */ 891 + if (retval == -EOVERFLOW) 892 + offset = 0; 893 + break; 887 894 } 888 895 889 896 copied = copy_to_iter(kernel_buf, size, to);