leandrof/linux
1
0
Fork 0
forked from Minki/linux
Code Issues Pull Requests Packages Projects Releases Wiki Activity

fs/pipe.c: return error code rather than 0 in pipe_write()

Browse Source 
pipe_write() would return 0 if it failed to merge the beginning of the
data to write with the last, partially filled pipe buffer.  It should
return an error code instead.  Userspace programs could be confused by
write() returning 0 when called with a nonzero 'count'.

The EFAULT error case was a regression from f0d1bec9d5 ("new helper:
copy_page_from_iter()"), while the ops->confirm() error case was a much
older bug.

Test program:

	#include <assert.h>
	#include <errno.h>
	#include <unistd.h>

	int main(void)
	{
		int fd[2];
		char data[1] = {0};

		assert(0 == pipe(fd));
		assert(1 == write(fd[1], data, 1));

		/* prior to this patch, write() returned 0 here  */
		assert(-1 == write(fd[1], NULL, 1));
		assert(errno == EFAULT);
	}

Cc: stable@vger.kernel.org # at least v3.15+
Signed-off-by: Eric Biggers <ebiggers3@gmail.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
This commit is contained in:
Eric Biggers 2015-10-17 16:26:09 -05:00 committed by Al Viro
parent e9bb1f9b12
commit 6ae0806993
1 changed files with 4 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
fs/pipe.c
View File

@ -366,18 +366,17 @@ pipe_write(struct kiocb *iocb, struct iov_iter *from)
int offset = buf->offset + buf->len; int offset = buf->offset + buf->len;
if (ops->can_merge && offset + chars <= PAGE_SIZE) { if (ops->can_merge && offset + chars <= PAGE_SIZE) {
int error = ops->confirm(pipe, buf); ret = ops->confirm(pipe, buf);
if (error) if (ret)
goto out; goto out;
ret = copy_page_from_iter(buf->page, offset, chars, from); ret = copy_page_from_iter(buf->page, offset, chars, from);
if (unlikely(ret < chars)) { if (unlikely(ret < chars)) {
error = -EFAULT; ret = -EFAULT;
goto out; goto out;
} }
do_wakeup = 1; do_wakeup = 1;
buf->len += chars; buf->len += ret;
ret = chars;
if (!iov_iter_count(from)) if (!iov_iter_count(from))
goto out; goto out;
} }