copy_from_user() returns the number of bytes remaining to be copied,
and it fails if user pointer is invalid, so return -EFAULT
so that the user gets a FAULT.
Signed-off-by: Devendra Naga <devendra.aaru@xxxxxxxxx>
---
drivers/staging/sep/sep_main.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/staging/sep/sep_main.c b/drivers/staging/sep/sep_main.c
index a414e52..2c8df0e 100644
--- a/drivers/staging/sep/sep_main.c
+++ b/drivers/staging/sep/sep_main.c
@@ -3431,7 +3431,7 @@ static ssize_t sep_create_dcb_dmatables_context(struct sep_device *sep,
if (copy_from_user(dcb_args,
user_dcb_args,
num_dcbs * sizeof(struct build_dcb_struct))) {
- error = -EINVAL;
+ error = -EFAULT;
goto end_function;
}
@@ -3619,7 +3619,7 @@ static ssize_t sep_create_msgarea_context(struct sep_device *sep,
/* Copy input data to write() to allocated message buffer */
if (copy_from_user(*msg_region, msg_user, msg_len)) {
- error = -EINVAL;
+ error = -EFAULT;
goto end_function;
}
--
1.7.10.4
_______________________________________________
devel mailing list
devel@xxxxxxxxxxxxxxxxxxxxxx
http://driverdev.linuxdriverproject.org/mailman/listinfo/devel
