net: Fix wrong interpretation of some copy_to_user() results.

[ Upstream commit: 653252c2302cdf2dfbca66a7e177f7db783f9efa ]

I found some places, that erroneously return the value obtained from
the copy_to_user() call: if some amount of bytes were not able to get
to the user (this is what this one returns) the proper behavior is to
return the -EFAULT error, not that number itself.

Signed-off-by: Pavel Emelyanov <xemul@openvz.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

diff --git a/net/can/raw.c b/net/can/raw.c
index 94cd7f27c44470109263bd653301e9944b403496..c92cb8e48a23be9c325c4e7a395102ef0676a0d1 100644 (file)
--- a/net/can/raw.c
+++ b/net/can/raw.c
@@ -573,7 +573,8 @@ static int raw_getsockopt(struct socket *sock, int level, int optname,
                        int fsize = ro->count * sizeof(struct can_filter);
                        if (len > fsize)
                                len = fsize;
-                       err = copy_to_user(optval, ro->filter, len);
+                       if (copy_to_user(optval, ro->filter, len))
+                               err = -EFAULT;
                } else
                        len = 0;
                release_sock(sk);

diff --git a/net/dccp/probe.c b/net/dccp/probe.c
index 7053bb827bc88c34ca6a47bdcf9644425bc74c25..44eddcf5f49d6d11dff0aa6ff499267db91b4c1b 100644 (file)
--- a/net/dccp/probe.c
+++ b/net/dccp/probe.c
@@ -145,7 +145,7 @@ static ssize_t dccpprobe_read(struct file *file, char __user *buf,
                goto out_free;
 
        cnt = kfifo_get(dccpw.fifo, tbuf, len);
-       error = copy_to_user(buf, tbuf, cnt);
+       error = copy_to_user(buf, tbuf, cnt) ? -EFAULT : 0;
 
 out_free:
        vfree(tbuf);

diff --git a/net/tipc/socket.c b/net/tipc/socket.c
index 22909036b9bc35195a84408b4f9e23440464f189..ac0473370e77b0d9964256d80808b3750586e3e6 100644 (file)
--- a/net/tipc/socket.c
+++ b/net/tipc/socket.c
@@ -1600,8 +1600,8 @@ static int getsockopt(struct socket *sock,
        else if (len < sizeof(value)) {
                res = -EINVAL;
        }
-       else if ((res = copy_to_user(ov, &value, sizeof(value)))) {
-               /* couldn't return value */
+       else if (copy_to_user(ov, &value, sizeof(value))) {
+               res = -EFAULT;
        }
        else {
                res = put_user(sizeof(value), ol);