On Wed, Apr 03, 2024 at 08:02:52AM -0600, Jens Axboe wrote: > - res = put_user(ticks, (u64 __user *) buf) ? -EFAULT: sizeof(ticks); > + res = copy_to_iter(&ticks, sizeof(ticks), to); Umm... That's not an equivalent transformation - different behaviour on short copy; try to call it via read(fd, unmapped_buffer, 8) and see what happens. copy_to_iter() returns the amount copied; no data copied => return 0, not -EFAULT. > + ufd = get_unused_fd_flags(O_RDWR | (flags & TFD_SHARED_FCNTL_FLAGS)); You do realize that get_unused_fd_flags() ignores O_RDWR (or O_NDELAY), right? Mixing those with O_CLOEXEC makes sense for anon_inode_getfd(), but here you have separate calls of get_unused_fd_flags() and anon_inode_getfile(), so...
