[PATCH] virtio: nsm: fix raw ioctl copy error path

[PATCH] virtio: nsm: fix raw ioctl copy error path

[Yousef Alhouseen]

nsm_dev_ioctl() uses a common exit path which unlocks nsm->lock.

A failed copy_from_user() reaches that path before the mutex is locked.

Return -EFAULT directly for that pre-lock failure.

Signed-off-by: Yousef Alhouseen <alhouseenyousef@gmail.com>
---
 drivers/misc/nsm.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/drivers/misc/nsm.c b/drivers/misc/nsm.c
index ef7b32742..e39ff0071 100644
--- a/drivers/misc/nsm.c
+++ b/drivers/misc/nsm.c
@@ -365,9 +365,8 @@ static long nsm_dev_ioctl(struct file *file, unsigned int cmd,
 		return -EINVAL;
 
 	/* Copy user argument struct to kernel argument struct */
-	r = -EFAULT;
 	if (copy_from_user(&raw, argp, _IOC_SIZE(cmd)))
-		goto out;
+		return -EFAULT;
 
 	mutex_lock(&nsm->lock);
 
-- 
2.54.0

Re: [PATCH] virtio: nsm: fix raw ioctl copy error path

[Arnd Bergmann]

On Wed, Jun 24, 2026, at 19:35, Yousef Alhouseen wrote:
> nsm_dev_ioctl() uses a common exit path which unlocks nsm->lock.
>
> A failed copy_from_user() reaches that path before the mutex is locked.
>
> Return -EFAULT directly for that pre-lock failure.
>
> Signed-off-by: Yousef Alhouseen <alhouseenyousef@gmail.com>
> ---

Reviewed-by: Arnd Bergmann <arnd@arndb.de>

Re: [PATCH] virtio: nsm: fix raw ioctl copy error path

[Greg Kroah-Hartman]

On Wed, Jun 24, 2026 at 07:35:01PM +0200, Yousef Alhouseen wrote:
> nsm_dev_ioctl() uses a common exit path which unlocks nsm->lock.
> 
> A failed copy_from_user() reaches that path before the mutex is locked.
> 
> Return -EFAULT directly for that pre-lock failure.
> 
> Signed-off-by: Yousef Alhouseen <alhouseenyousef@gmail.com>
> ---
>  drivers/misc/nsm.c | 3 +--
>  1 file changed, 1 insertion(+), 2 deletions(-)

The subject says "virtio" yet that is not what this driver is :(

Can you fix that up and resend?

thanks,

greg k-h