From mboxrd@z Thu Jan  1 00:00:00 1970
From: Wei Liu <wei.liu2@citrix.com>
Subject: Re: [PATCH net-next v4] xen-netback: Adding debugfs
 "io_ring_qX" files
Date: Mon, 11 Aug 2014 11:38:02 +0100
Message-ID: <20140811103802.GA3249@zion.uk.xensource.com>
References: <CAPmhDMZ5s0GZ-dceZ-2SghXvpj-YiQOCb-dnc5D+iUSFpyyTgQ@mail.gmail.com>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Return-path: <xen-devel-bounces@lists.xen.org>
Content-Disposition: inline
In-Reply-To: <CAPmhDMZ5s0GZ-dceZ-2SghXvpj-YiQOCb-dnc5D+iUSFpyyTgQ@mail.gmail.com>
List-Unsubscribe: <http://lists.xen.org/cgi-bin/mailman/options/xen-devel>,
	<mailto:xen-devel-request@lists.xen.org?subject=unsubscribe>
List-Post: <mailto:xen-devel@lists.xen.org>
List-Help: <mailto:xen-devel-request@lists.xen.org?subject=help>
List-Subscribe: <http://lists.xen.org/cgi-bin/mailman/listinfo/xen-devel>,
	<mailto:xen-devel-request@lists.xen.org?subject=subscribe>
Sender: xen-devel-bounces@lists.xen.org
Errors-To: xen-devel-bounces@lists.xen.org
To: SeeChen Ng <seechen81@gmail.com>
Cc: wei.liu2@citrix.com, xen-devel@lists.xen.org
List-Id: xen-devel@lists.xenproject.org

On Sun, Aug 10, 2014 at 10:57:51PM +0800, SeeChen Ng wrote:
> Hi, I'm a noob to linux kernel, I tried to figure out the usage of the function
> "simple_write_to_buffer", and I got confused about the code here.
> 
> > +static ssize_t
> > +xenvif_write_io_ring(struct file *filp, const char __user *buf, size_t count,
> > +                    loff_t *ppos)
> > +{
> > +       struct xenvif_queue *queue =
> > +               ((struct seq_file *)filp->private_data)->private;
> > +       int len;
> > +       char write[sizeof(XENVIF_KICK_STR)];
> > +
> > +       /* don't allow partial writes and check the length */
> > +       if (*ppos != 0)
> > +               return 0;
> > +       if (count < sizeof(XENVIF_KICK_STR) - 1)
> > +               return -ENOSPC;
> The statement here is trying to verify the value of "count" is smaller
> than the size of array "write", make sure that the array got
> enough space for the write operation, right?
> 

Yes I think so.

> So, I think the statement should be:
> 
>          if (count >= sizeof(XENVIF_KICK_STR))
>                  return -ENOSPC;
> 

 * sizeof(XENVIF_KICK_STR) = 5
 * count is the number of bytes needs to be written, in the case of "kick"
   it's 5 because the tailing '\0' is also counted.

so the correct fix should be

  if (count > sizeof(XENVIF_KICK_STR))
          return -ENOSPC;

Do you want to submit a proper patch to fix it?

You can have a look at Documentation/SubmittingPatches for general
instructions on how to submit patch. And have a look at
Documentation/networking/netdev-FAQ.txt for network related patches.

If you have no interest in fixing it I can fix it myself.

Wei.