diff options
| author | Jian Zhang <zhangjian.3032@bytedance.com> | 2026-04-03 12:05:59 +0300 |
|---|---|---|
| committer | Corey Minyard <corey@minyard.net> | 2026-04-03 15:49:53 +0300 |
| commit | ea641be7a4faee4351f9c5ed6b188e1bbf5586a6 (patch) | |
| tree | f7bf0230c14250becf042c17fd9be14e4e59cb2f | |
| parent | 7fc3e2546cf3fa9a28a2acc92a512c779a8e5038 (diff) | |
| download | linux-ea641be7a4faee4351f9c5ed6b188e1bbf5586a6.tar.xz | |
ipmi: ssif_bmc: fix missing check for copy_to_user() partial failure
copy_to_user() returns the number of bytes that could not be copied,
with a non-zero value indicating a partial or complete failure. The
current code only checks for negative return values and treats all
non-negative results as success.
Treating any positive return value from copy_to_user() as
an error and returning -EFAULT.
Fixes: dd2bc5cc9e25 ("ipmi: ssif_bmc: Add SSIF BMC driver")
Signed-off-by: Jian Zhang <zhangjian.3032@bytedance.com>
Message-ID: <20260403090603.3988423-2-zhangjian.3032@bytedance.com>
Signed-off-by: Corey Minyard <corey@minyard.net>
| -rw-r--r-- | drivers/char/ipmi/ssif_bmc.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/drivers/char/ipmi/ssif_bmc.c b/drivers/char/ipmi/ssif_bmc.c index dc1d5bb4a460..fbc7d2cfd535 100644 --- a/drivers/char/ipmi/ssif_bmc.c +++ b/drivers/char/ipmi/ssif_bmc.c @@ -163,6 +163,8 @@ static ssize_t ssif_bmc_read(struct file *file, char __user *buf, size_t count, spin_unlock_irqrestore(&ssif_bmc->lock, flags); ret = copy_to_user(buf, &msg, count); + if (ret > 0) + ret = -EFAULT; } return (ret < 0) ? ret : count; |