[PATCH] copy_to_user checking in select.c

Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

diff --git a/fs/select.c b/fs/select.c
index 4dbc1d99a05ef8affbeb328c916ea775ef053a3c..dfff0ad1baf5231e492dc7d1c1f314afaf94adac 100644 (file)
--- a/fs/select.c
+++ b/fs/select.c
@@ -373,9 +373,10 @@ sys_select(int n, fd_set __user *inp, fd_set __user *outp, fd_set __user *exp, s
                ret = 0;
        }
 
-       set_fd_set(n, inp, fds.res_in);
-       set_fd_set(n, outp, fds.res_out);
-       set_fd_set(n, exp, fds.res_ex);
+       if (set_fd_set(n, inp, fds.res_in) ||
+           set_fd_set(n, outp, fds.res_out) ||
+           set_fd_set(n, exp, fds.res_ex))
+               ret = -EFAULT;
 
 out:
        select_bits_free(bits, size);

diff --git a/include/linux/poll.h b/include/linux/poll.h
index b4bb681fd1ca08c76d4570ef63f281bd7b50f17c..1bb33342cbbdfda3861c7c1c02fb7eff0a65c962 100644 (file)
--- a/include/linux/poll.h
+++ b/include/linux/poll.h
@@ -5,6 +5,7 @@
 
 #ifdef __KERNEL__
 
+#include <linux/compiler.h>
 #include <linux/wait.h>
 #include <linux/string.h>
 #include <linux/mm.h>
@@ -81,11 +82,12 @@ int get_fd_set(unsigned long nr, void __user *ufdset, unsigned long *fdset)
        return 0;
 }
 
-static inline
-void set_fd_set(unsigned long nr, void __user *ufdset, unsigned long *fdset)
+static inline unsigned long __must_check
+set_fd_set(unsigned long nr, void __user *ufdset, unsigned long *fdset)
 {
        if (ufdset)
-               __copy_to_user(ufdset, fdset, FDS_BYTES(nr));
+               return __copy_to_user(ufdset, fdset, FDS_BYTES(nr));
+       return 0;
 }
 
 static inline