From 702e1a9bd2c3731533181c684da939b1c5c89171 Mon Sep 17 00:00:00 2001 From: Jesper Juhl Date: Thu, 2 Sep 2004 20:26:40 -0700 Subject: [PATCH] [PATCH] read_ldt() neglects to check clear_user() return value akpm: It's a bit debatable. The user passed in a buffer of a particular size, and we successfully sopied the LDT info into it, but we got a fault when clearing out the rest of the user's buffer. Is that worth a -EFAULT? I suppose so... Signed-off-by: Jesper Juhl Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds --- arch/i386/kernel/ldt.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/arch/i386/kernel/ldt.c b/arch/i386/kernel/ldt.c index 038d30034a807..bb50afbee921c 100644 --- a/arch/i386/kernel/ldt.c +++ b/arch/i386/kernel/ldt.c @@ -142,12 +142,17 @@ static int read_ldt(void __user * ptr, unsigned long bytecount) err = -EFAULT; up(&mm->context.sem); if (err < 0) - return err; + goto error_return; if (size != bytecount) { /* zero-fill the rest */ - clear_user(ptr+size, bytecount-size); + if (clear_user(ptr+size, bytecount-size) != 0) { + err = -EFAULT; + goto error_return; + } } return bytecount; +error_return: + return err; } static int read_default_ldt(void __user * ptr, unsigned long bytecount) -- 2.53.0