torvalds/linux
3
0
Fork 0
mirror of git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2026-03-22 07:27:12 +08:00
Code Issues Packages Projects Releases Wiki Activity

pwm: Ensure ioctl() returns a negative errno on error

Browse Source 
copy_to_user() returns the number of bytes not copied, thus if there is
a problem a positive number. However the ioctl callback is supposed to
return a negative error code on error.

This error is a unfortunate as strictly speaking it became ABI with the
introduction of pwm character devices. However I never saw the issue in
real life -- I found this by code inspection -- and it only affects an
error case where readonly memory is passed to the ioctls or the address
mapping changes while the ioctl is active. Also there are already error
cases returning negative values, so the calling code must be prepared to
see such values already.

Fixes: 9c06f26ba5 ("pwm: Add support for pwmchip devices for faster and easier userspace access")
Signed-off-by: Uwe Kleine-König <u.kleine-koenig@baylibre.com>
Link: https://patch.msgid.link/20260119151325.571857-2-u.kleine-koenig@baylibre.com
Signed-off-by: Uwe Kleine-König <ukleinek@kernel.org>
This commit is contained in:
Uwe Kleine-König
2026-01-19 16:13:26 +01:00
committed by Uwe Kleine-König
parent 8f0b4cce44
commit c198b7773c
1 changed files with 6 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
drivers/pwm/core.c
View File

@@ -2295,8 +2295,9 @@ static long pwm_cdev_ioctl(struct file *file, unsigned int cmd, unsigned long ar
.duty_offset_ns = wf.duty_offset_ns,
};
return copy_to_user((struct pwmchip_waveform __user *)arg,
&cwf, sizeof(cwf));
ret = copy_to_user((struct pwmchip_waveform __user *)arg,
&cwf, sizeof(cwf));
return ret ? -EFAULT : 0;
}
case PWM_IOCTL_GETWF:
@@ -2329,8 +2330,9 @@ static long pwm_cdev_ioctl(struct file *file, unsigned int cmd, unsigned long ar
.duty_offset_ns = wf.duty_offset_ns,
};
return copy_to_user((struct pwmchip_waveform __user *)arg,
&cwf, sizeof(cwf));
ret = copy_to_user((struct pwmchip_waveform __user *)arg,
&cwf, sizeof(cwf));
return ret ? -EFAULT : 0;
}
case PWM_IOCTL_SETROUNDEDWF: