Re: strict copy_from_user checks issues?

[Arnd Bergmann]

On Friday 08 January 2010 00:57:51 H. Peter Anvin wrote:
> On 01/07/2010 06:02 AM, Arnd Bergmann wrote:
>
> > On a related topic, one interface that may actually be worth adding is
> > a get_user/put_user variant that can operate on full data structures
> > and return -EFAULT on failure rather than the number of remaining
> > bytes that 99% of the code never need.
> 
> What is wrong with checking for zero?

It's counterintuitive. Everyone who is around long enough should know about
the copy_from_user calling conventions, but the fact that Arjan submitted
a patch returning EFAULT from copy_from_user and Ingo and Dave both added
this to their trees tells me that it's less than ideal.

Also, the calling conventions require you to write slightly more when
you want to pass down an error value, e.g.

	return copy_to_user(uptr, &data, sizeof(data)) ? -EFAULT : 0;

instead of

	return put_user(data, uptr);

The latter form requires a macro instead of a function for the user copy,
but we now have that anyway because of the size check.

	Arnd
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/