From 06279f4326daf336cdeaa02fee74fd8ac787e033 Mon Sep 17 00:00:00 2001 From: Dmitry Torokhov Date: Wed, 2 May 2012 00:13:38 -0700 Subject: [PATCH] Input: serio_raw - signal EFAULT even if read/write partially succeeds When copy_to/from_user fails in the middle of transfer we should not report to the user that read/write partially succeeded but rather report -EFAULT right away, so that application will know that it got its buffers all wrong. If application messed up its buffers we can't trust the data fetched from userspace and successfully written to the device or if data read from the device and transferred to userspace ended up where application expected it to end. If serio_write() fails we still going to report partial writes if failure happens in the middle of the transfer. This is basically a revert of 98804a8ff7df2873cf2b6ea3234599b5062b6605 and 5e5f57022ba9461654396a44573e2c60d8f15745. Signed-off-by: Dmitry Torokhov --- drivers/input/serio/serio_raw.c | 33 ++++++++++++++++++--------------- 1 file changed, 18 insertions(+), 15 deletions(-) diff --git a/drivers/input/serio/serio_raw.c b/drivers/input/serio/serio_raw.c index 3e243621c0e30..59df2e7317a3c 100644 --- a/drivers/input/serio/serio_raw.c +++ b/drivers/input/serio/serio_raw.c @@ -165,9 +165,9 @@ static ssize_t serio_raw_read(struct file *file, char __user *buffer, struct serio_raw *serio_raw = client->serio_raw; char uninitialized_var(c); ssize_t read = 0; - int error = 0; + int error; - do { + for (;;) { if (serio_raw->dead) return -ENODEV; @@ -179,24 +179,24 @@ static ssize_t serio_raw_read(struct file *file, char __user *buffer, break; while (read < count && serio_raw_fetch_byte(serio_raw, &c)) { - if (put_user(c, buffer++)) { - error = -EFAULT; - goto out; - } + if (put_user(c, buffer++)) + return -EFAULT; read++; } if (read) break; - if (!(file->f_flags & O_NONBLOCK)) + if (!(file->f_flags & O_NONBLOCK)) { error = wait_event_interruptible(serio_raw->wait, serio_raw->head != serio_raw->tail || serio_raw->dead); - } while (!error); + if (error) + return error; + } + } -out: - return read ?: error; + return read; } static ssize_t serio_raw_write(struct file *file, const char __user *buffer, @@ -204,8 +204,7 @@ static ssize_t serio_raw_write(struct file *file, const char __user *buffer, { struct serio_raw_client *client = file->private_data; struct serio_raw *serio_raw = client->serio_raw; - ssize_t written = 0; - int retval; + int retval = 0; unsigned char c; retval = mutex_lock_interruptible(&serio_raw_mutex); @@ -225,16 +224,20 @@ static ssize_t serio_raw_write(struct file *file, const char __user *buffer, retval = -EFAULT; goto out; } + if (serio_write(serio_raw->serio, c)) { - retval = -EIO; + /* Either signal error or partial write */ + if (retval == 0) + retval = -EIO; goto out; } - written++; + + retval++; } out: mutex_unlock(&serio_raw_mutex); - return written ?: retval; + return retval; } static unsigned int serio_raw_poll(struct file *file, poll_table *wait) -- 2.39.5