Bug in __copy_user

[Carsten Langgaard <carstenl@mips.com>]

[-- Attachment #1: Type: text/plain, Size: 1155 bytes --]

I have started to look a little bit at the LTP tests.
And one of the testcases that fails (actually it doesn't fail as it
supposed to do) is the syscall getsockopt.
I think the failure is due to the copy_to_user(0, from, 4) call returns
0, which I wouldn't expect when the destination pointer is NULL.

I think the problem is in the __copy_user function in
arch/mips/lib/memcpy.
It tries to handle the exception, which we get because the destination
pointer is NULL, by returning the number of uncopied bytes in $a2 to the
caller.
But in this case the length is only 4 bytes, and the copying is done by
a single 'sw'. The problem is the length ($a2) is decreased by 4 before
the 'sw' is executed.
The 'sw' fails and __copy_user terminates, but returns with $a2 = 0
(instead 4).

I thing the following patch will solve the problem.

/Carsten



--
_    _ ____  ___   Carsten Langgaard   Mailto:carstenl@mips.com
|\  /|||___)(___   MIPS Denmark        Direct: +45 4486 5527
| \/ |||    ____)  Lautrupvang 4B      Switch: +45 4486 5555
  TECHNOLOGIES     2750 Ballerup       Fax...: +45 4486 5556
                   Denmark             http://www.mips.com



[-- Attachment #2: memcpy.patch --]
[-- Type: text/plain, Size: 538 bytes --]

Index: arch/mips/lib/memcpy.S
===================================================================
RCS file: /home/repository/sw/linux-2.4.18/arch/mips/lib/memcpy.S,v
retrieving revision 1.1.1.1
diff -u -r1.1.1.1 memcpy.S
--- arch/mips/lib/memcpy.S	4 Mar 2002 11:12:21 -0000	1.1.1.1
+++ arch/mips/lib/memcpy.S	24 Jun 2002 13:46:07 -0000
@@ -248,8 +248,8 @@
 1:
 EXC(	LOAD	 t0, 0(src),		l_exc)
 	ADD	src, src, NBYTES
-	SUB	len, len, NBYTES
 EXC(	STORE	t0, 0(dst),		s_exc)
+	SUB	len, len, NBYTES
 	bne	rem, len, 1b
 	 ADD	dst, dst, NBYTES