scsi: cxlflash: return -EFAULT if copy_from_user() fails
authorDan Carpenter <dan.carpenter@oracle.com>
Fri, 30 Jun 2017 08:01:06 +0000 (11:01 +0300)
committerMartin K. Petersen <martin.petersen@oracle.com>
Wed, 12 Jul 2017 21:06:51 +0000 (17:06 -0400)
The copy_from/to_user() functions return the number of bytes remaining
to be copied but we had intended to return -EFAULT here.

Fixes: bc88ac47d5cb ("scsi: cxlflash: Support AFU debug")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Matthew R. Ochs <mrochs@linux.vnet.ibm.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
drivers/scsi/cxlflash/main.c

index 077f62e208aaef5125756ecd30273176698a7bc7..6a4367cc9caabea8f0bbc1519d309ab50b55578f 100644 (file)
@@ -3401,9 +3401,10 @@ static int cxlflash_afu_debug(struct cxlflash_cfg *cfg,
                if (is_write) {
                        req_flags |= SISL_REQ_FLAGS_HOST_WRITE;
 
-                       rc = copy_from_user(kbuf, ubuf, ulen);
-                       if (unlikely(rc))
+                       if (copy_from_user(kbuf, ubuf, ulen)) {
+                               rc = -EFAULT;
                                goto out;
+                       }
                }
        }
 
@@ -3431,8 +3432,10 @@ static int cxlflash_afu_debug(struct cxlflash_cfg *cfg,
                goto out;
        }
 
-       if (ulen && !is_write)
-               rc = copy_to_user(ubuf, kbuf, ulen);
+       if (ulen && !is_write) {
+               if (copy_to_user(ubuf, kbuf, ulen))
+                       rc = -EFAULT;
+       }
 out:
        kfree(buf);
        dev_dbg(dev, "%s: returning rc=%d\n", __func__, rc);