PATCH: 2.2.16pre8 n_tty.c copy_to_user

[David Teigland]

Can someone verify if this is sane or that I am insane?

Thanks,
Dave Teigland


diff -u --new-file --recursive linux-2.2.16-pre8/drivers/char/n_tty.c 
linux-2.2.16-pre8.patch/drivers/char/n_tty.c
--- linux-2.2.16-pre8/drivers/char/n_tty.c      Tue Jun  6 15:08:21 2000
+++ linux-2.2.16-pre8.patch/drivers/char/n_tty.c        Tue Jun  6 15:35:17 2000
@@ -888,24 +888,27 @@
                                      size_t *nr)
 
 {
-       int retval;
+       int retval = 0;
        ssize_t n;
        unsigned long flags;
 
-       retval = 0;
+
        spin_lock_irqsave(&tty->read_lock, flags);
        n = MIN(*nr, MIN(tty->read_cnt, N_TTY_BUF_SIZE - tty->read_tail));
        spin_unlock_irqrestore(&tty->read_lock, flags);
+
        if (n) {
                mb();
-               retval = copy_to_user(*b, &tty->read_buf[tty->read_tail], n);
-               n -= retval;
+               if (copy_to_user(*b, &tty->read_buf[tty->read_tail], n))
+                       return -EFAULT;
+
                spin_lock_irqsave(&tty->read_lock, flags);
                tty->read_tail = (tty->read_tail + n) & (N_TTY_BUF_SIZE-1);
                tty->read_cnt -= n;
                spin_unlock_irqrestore(&tty->read_lock, flags);
                *b += n;
                *nr -= n;
+               retval = n;
        }
        return retval;
 }
@@ -1060,13 +1063,13 @@
                                }
                        }
                } else {
-                       int uncopied;
-                       uncopied = copy_from_read_buf(tty, &b, &nr);
-                       uncopied += copy_from_read_buf(tty, &b, &nr);
-                       if (uncopied) {
-                               retval = -EFAULT;
-                               break;
-                       }
+                       retval = copy_from_read_buf(tty, &b, &nr);
+                       if (retval < 0)
+                         break;
+
+                       retval = copy_from_read_buf(tty, &b, &nr);
+                       if (retval < 0)
+                         break;
                }
 
                /* If there is enough space in the read buffer now, let the


-
To unsubscribe from this list: send the line "unsubscribe linux-serial" in
the body of a message to [EMAIL PROTECTED]