Cc: Linus Torvalds <torvalds@...>, Bron Gondwana <brong@...>, Linux Kernel Mailing List <linux-kernel@...>, Nick Piggin <npiggin@...>, Andrew Morton <akpm@...>, Rob Mueller <robm@...>, Ingo Molnar <mingo@...>
Well on x86 it is reachable, so it only handles faults.
Linus seems to think that copy_to_user() should have
copy_in_user semantics(). It happens to be in some cases (when string instructions
are used), but not for the unrolled case.
What seems also confusing him is that x86-64 copy_from/to_user use a shared
subfunction. The trick that this subfunction uses is to assume that
either the destination faults or the source, but never both. It's legal
because the caller should never pass in a faulting source for copy to
or a faulting destination for copy from.
Actually they handle it, but the return value is not correct.
Now he "fixed" copy_to_user to return a kind of correct return value
for source faults, but it'll of course break copy_from_user()'s return value.
It's still unclear why his patch fixes the test case. The caller should
be using copy_in_user perhaps? Or is it just buggy by passing something
unmapped to copy_to_user?
-Andi
--
