From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-0.8 required=3.0 tests=HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS autolearn=no autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id A08DCC47253 for ; Fri, 1 May 2020 17:43:11 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 8547F2166E for ; Fri, 1 May 2020 17:43:11 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1729744AbgEARnL (ORCPT ); Fri, 1 May 2020 13:43:11 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:34174 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-FAIL-OK-FAIL) by vger.kernel.org with ESMTP id S1729572AbgEARnL (ORCPT ); Fri, 1 May 2020 13:43:11 -0400 Received: from ZenIV.linux.org.uk (zeniv.linux.org.uk [IPv6:2002:c35c:fd02::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id CD65FC061A0C; Fri, 1 May 2020 10:43:10 -0700 (PDT) Received: from viro by ZenIV.linux.org.uk with local (Exim 4.92.3 #3 (Red Hat Linux)) id 1jUZgo-00G5Gh-Jb; Fri, 01 May 2020 17:43:06 +0000 Date: Fri, 1 May 2020 18:43:06 +0100 From: Al Viro To: Jens Axboe Cc: linux-fsdevel , "linux-kernel@vger.kernel.org" Subject: Re: [PATCH v2] eventfd: convert to f_op->read_iter() Message-ID: <20200501174306.GM23230@ZenIV.linux.org.uk> References: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: Sender: linux-fsdevel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-fsdevel@vger.kernel.org On Fri, May 01, 2020 at 11:18:05AM -0600, Jens Axboe wrote: > - if (res > 0 && put_user(ucnt, (__u64 __user *)buf)) > + if (res > 0 && copy_to_iter(&ucnt, res, iov) < res) *whoa* It is correct, but only because here res > 0 <=> res == 8. And that's not trivial at the first glance. Please, turn that into something like if (iov_iter_count(to) < sizeof(ucnt)) return -EINVAL; spin_lock_irq(&ctx->wqh.lock); if (!ctx->count) { if (unlikely(file->f_flags & O_NONBLOCK) { spin_unlock_irq(&ctx->wqh.lock) return -EAGAIN; } __add_wait_queue(&ctx->wqh, &wait); for (;;) { set_current_state(TASK_INTERRUPTIBLE); if (ctx->count) break; if (signal_pending(current)) { spin_unlock_irq(&ctx->wqh.lock) return -ERESTARTSYS; } spin_unlock_irq(&ctx->wqh.lock); schedule(); spin_lock_irq(&ctx->wqh.lock); } __remove_wait_queue(&ctx->wqh, &wait); __set_current_state(TASK_RUNNING); } eventfd_ctx_do_read(ctx, &ucnt); if (waitqueue_active(&ctx->wqh)) wake_up_locked_poll(&ctx->wqh, EPOLLOUT); spin_unlock_irq(&ctx->wqh.lock); if (unlikely(copy_to_iter(&ucnt, sizeof(ucnt), to) != sizeof(ucnt))) return -EFAULT; return sizeof(ucnt);