linux-kernel - [PATCH] powerpc/pseries: papr-hvpipe: Return -EFAULT on copy_to

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20251224083116.23904-1-alperyasinak1@gmail.com>
Date: Wed, 24 Dec 2025 11:31:10 +0300
From: Alper Ak <alperyasinak1@...il.com>
To: linuxppc-dev@...ts.ozlabs.org,
	linux-kernel@...r.kernel.org
Cc: Alper Ak <alperyasinak1@...il.com>,
	kernel test robot <lkp@...el.com>,
	Dan Carpenter <error27@...il.com>,
	Madhavan Srinivasan <maddy@...ux.ibm.com>,
	Michael Ellerman <mpe@...erman.id.au>,
	Nicholas Piggin <npiggin@...il.com>,
	"Christophe Leroy (CS GROUP)" <chleroy@...nel.org>,
	Tyrel Datwyler <tyreld@...ux.ibm.com>,
	Mahesh Salgaonkar <mahesh@...ux.ibm.com>,
	Haren Myneni <haren@...ux.ibm.com>,
	Christian Brauner <brauner@...nel.org>
Subject: [PATCH] powerpc/pseries: papr-hvpipe: Return -EFAULT on copy_to_user() failure

copy_to_user() returns the number of bytes that could not be copied,
not an error code. Currently, hvpipe_rtas_recv_msg() and
papr_hvpipe_handle_read() return this positive value directly on
failure, which userspace interprets as a successful read of that
many bytes.

Return -EFAULT when copy_to_user() fails.

Reported-by: kernel test robot <lkp@...el.com>
Reported-by: Dan Carpenter <error27@...il.com>
Closes: https://lore.kernel.org/r/202512240028.EKDG3Wu6-lkp@intel.com/
Signed-off-by: Alper Ak <alperyasinak1@...il.com>
---
 arch/powerpc/platforms/pseries/papr-hvpipe.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/arch/powerpc/platforms/pseries/papr-hvpipe.c b/arch/powerpc/platforms/pseries/papr-hvpipe.c
index dd7b668799d9..0dee94c7c887 100644
--- a/arch/powerpc/platforms/pseries/papr-hvpipe.c
+++ b/arch/powerpc/platforms/pseries/papr-hvpipe.c
@@ -209,7 +209,9 @@ static int hvpipe_rtas_recv_msg(char __user *buf, int size)
 			ret = copy_to_user(buf,
 					rtas_work_area_raw_buf(work_area),
 					bytes_written);
-			if (!ret)
+			if (ret)
+				ret = -EFAULT;
+			else
 				ret = bytes_written;
 		}
 	} else {
@@ -376,7 +378,7 @@ static ssize_t papr_hvpipe_handle_read(struct file *file,
 
 	ret = copy_to_user(buf, &hdr, HVPIPE_HDR_LEN);
 	if (ret)
-		return ret;
+		return -EFAULT;
 
 	/*
 	 * Message event has payload, so get the payload with
-- 
2.43.0