On Wed, Jul 06, 2022 at 01:31:39PM +0300, Dan Carpenter wrote: > On Wed, Jul 06, 2022 at 01:21:59PM +0300, Dan Carpenter wrote: > > On Wed, Jul 06, 2022 at 12:05:37PM +0300, Péter Ujfalusi wrote: > > > > > > > > > On 06/07/2022 10:23, Dan Carpenter wrote: > > > > This function tries to return the number of bytes that it was able to > > > > copy to the user. However, because there are multiple calls to > > > > copy_to_user() in a row that means the bytes are not necessarily > > > > consecutive so it's not useful. Just return -EFAULT instead. > > > > > > The function is copying data from a circular buffer to a use buffer. > > > The single copy_to_user() is used when we don't have wrapping, the > > > 'double' copy_to_user() is when we wrap, so first copy is from the end > > > of the buffer then we copy the data from the start of the buffer to get > > > all data. > > > > Ok. But the bugs in the original code are real. I will resend. > > Actually that's not true. The bugs in the original code are something > that only affect users who deserve it? Yeah. Never mind. If you set up user space so the first copy fails and the second succeeds then you deserve it. regards, dan carpenter
