[Top] [All Lists]

Bug in __copy_user

To: Ralf Baechle <>, "" <>
Subject: Bug in __copy_user
From: Carsten Langgaard <>
Date: Mon, 24 Jun 2002 16:17:23 +0200
I have started to look a little bit at the LTP tests.
And one of the testcases that fails (actually it doesn't fail as it
supposed to do) is the syscall getsockopt.
I think the failure is due to the copy_to_user(0, from, 4) call returns
0, which I wouldn't expect when the destination pointer is NULL.

I think the problem is in the __copy_user function in
It tries to handle the exception, which we get because the destination
pointer is NULL, by returning the number of uncopied bytes in $a2 to the
But in this case the length is only 4 bytes, and the copying is done by
a single 'sw'. The problem is the length ($a2) is decreased by 4 before
the 'sw' is executed.
The 'sw' fails and __copy_user terminates, but returns with $a2 = 0
(instead 4).

I thing the following patch will solve the problem.


_    _ ____  ___   Carsten Langgaard
|\  /|||___)(___   MIPS Denmark        Direct: +45 4486 5527
| \/ |||    ____)  Lautrupvang 4B      Switch: +45 4486 5555
  TECHNOLOGIES     2750 Ballerup       Fax...: +45 4486 5556

Index: arch/mips/lib/memcpy.S
RCS file: /home/repository/sw/linux-2.4.18/arch/mips/lib/memcpy.S,v
retrieving revision
diff -u -r1.1.1.1 memcpy.S
--- arch/mips/lib/memcpy.S      4 Mar 2002 11:12:21 -0000
+++ arch/mips/lib/memcpy.S      24 Jun 2002 13:46:07 -0000
@@ -248,8 +248,8 @@
 EXC(   LOAD     t0, 0(src),            l_exc)
        ADD     src, src, NBYTES
-       SUB     len, len, NBYTES
 EXC(   STORE   t0, 0(dst),             s_exc)
+       SUB     len, len, NBYTES
        bne     rem, len, 1b
         ADD    dst, dst, NBYTES
<Prev in Thread] Current Thread [Next in Thread>