From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail.linuxfoundation.org ([140.211.169.12]:39297 "EHLO mail.linuxfoundation.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751597AbcBNWUQ (ORCPT ); Sun, 14 Feb 2016 17:20:16 -0500 Subject: Patch "fs/pipe.c: return error code rather than 0 in pipe_write()" has been added to the 4.3-stable tree To: ebiggers3@gmail.com, gregkh@linuxfoundation.org, viro@zeniv.linux.org.uk Cc: , From: Date: Sun, 14 Feb 2016 14:20:16 -0800 Message-ID: <145548841620145@kroah.com> MIME-Version: 1.0 Content-Type: text/plain; charset=ANSI_X3.4-1968 Content-Transfer-Encoding: 8bit Sender: stable-owner@vger.kernel.org List-ID: This is a note to let you know that I've just added the patch titled fs/pipe.c: return error code rather than 0 in pipe_write() to the 4.3-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: fs-pipe.c-return-error-code-rather-than-0-in-pipe_write.patch and it can be found in the queue-4.3 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let know about it. >>From 6ae08069939f17422835448acae76bda8d96b16a Mon Sep 17 00:00:00 2001 From: Eric Biggers Date: Sat, 17 Oct 2015 16:26:09 -0500 Subject: fs/pipe.c: return error code rather than 0 in pipe_write() From: Eric Biggers commit 6ae08069939f17422835448acae76bda8d96b16a upstream. pipe_write() would return 0 if it failed to merge the beginning of the data to write with the last, partially filled pipe buffer. It should return an error code instead. Userspace programs could be confused by write() returning 0 when called with a nonzero 'count'. The EFAULT error case was a regression from f0d1bec9d5 ("new helper: copy_page_from_iter()"), while the ops->confirm() error case was a much older bug. Test program: #include #include #include int main(void) { int fd[2]; char data[1] = {0}; assert(0 == pipe(fd)); assert(1 == write(fd[1], data, 1)); /* prior to this patch, write() returned 0 here */ assert(-1 == write(fd[1], NULL, 1)); assert(errno == EFAULT); } Signed-off-by: Eric Biggers Signed-off-by: Al Viro Signed-off-by: Greg Kroah-Hartman --- fs/pipe.c | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) --- a/fs/pipe.c +++ b/fs/pipe.c @@ -366,18 +366,17 @@ pipe_write(struct kiocb *iocb, struct io int offset = buf->offset + buf->len; if (ops->can_merge && offset + chars <= PAGE_SIZE) { - int error = ops->confirm(pipe, buf); - if (error) + ret = ops->confirm(pipe, buf); + if (ret) goto out; ret = copy_page_from_iter(buf->page, offset, chars, from); if (unlikely(ret < chars)) { - error = -EFAULT; + ret = -EFAULT; goto out; } do_wakeup = 1; - buf->len += chars; - ret = chars; + buf->len += ret; if (!iov_iter_count(from)) goto out; } Patches currently in stable-queue which might be from ebiggers3@gmail.com are queue-4.3/fs-pipe.c-return-error-code-rather-than-0-in-pipe_write.patch