Bug in copy_user

Bug in copy_user

[Gleb O. Raiko]

There is bug in __copy_user (arch/mips*/lib/memcpy.S). Tested for 2.4.18
kernels, but versions 2.2, 2.4, and  2.5 for both mips and mips64 seems
to have similar bug.

For kernel 2.4.18 and mips
__copy_user returns wrong value if len = 4...7 and dst isn't accessible.

Other versions behave almost the same, just borders differ.

For example,
read(0,NULL,len), len=4...7 
getsockopt/ioctl(fd, *GET*, NULL, sizeof(int))

returns success. Fortunately, they don't write to at address 0.

The following patch seems to be OK for 2.4.18:

less_than_4units:
        /*
         * rem = len % NBYTES
         */
        beq     rem, len, copy_bytes
         nop
1:
EXC(    LOAD     t0, 0(src),            l_exc)
        ADD     src, src, NBYTES
        SUB     len, len, NBYTES
-EXC(    STORE   t0, 0(dst),             s_exc)
+EXC(    STORE   t0, 0(dst),             s_exc_p1u)
        bne     rem, len, 1b
         ADD    dst, dst, NBYTES

Any comments?

Regards,
Gleb.