From a5c82e5622d1b7f479c9a43873c2c5ac1f67765c Mon Sep 17 00:00:00 2001 From: Dan Carpenter Date: Tue, 15 Dec 2015 09:00:40 -0200 Subject: [media] media-device: copy_to/from_user() returns positive The copy_to/from_user() functions return the number of bytes *not* copied. They don't return error codes. Fixes: 4f6b3f363475 ('media] media-device: add support for MEDIA_IOC_G_TOPOLOGY ioctl') Signed-off-by: Dan Carpenter Signed-off-by: Mauro Carvalho Chehab --- drivers/media/media-device.c | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-) (limited to 'drivers/media') diff --git a/drivers/media/media-device.c b/drivers/media/media-device.c index b3e19c22e699..30e3354d7481 100644 --- a/drivers/media/media-device.c +++ b/drivers/media/media-device.c @@ -376,18 +376,17 @@ static long media_device_get_topology(struct media_device *mdev, struct media_v2_topology ktopo; int ret; - ret = copy_from_user(&ktopo, utopo, sizeof(ktopo)); - - if (ret < 0) - return ret; + if (copy_from_user(&ktopo, utopo, sizeof(ktopo))) + return -EFAULT; ret = __media_device_get_topology(mdev, &ktopo); if (ret < 0) return ret; - ret = copy_to_user(utopo, &ktopo, sizeof(*utopo)); + if (copy_to_user(utopo, &ktopo, sizeof(*utopo))) + return -EFAULT; - return ret; + return 0; } static long media_device_ioctl(struct file *filp, unsigned int cmd, -- cgit v1.2.3-59-g8ed1b