Fix a long-standing bug. Error string has to be copyied from the user

process context.

Approved by:	phk
MFC after:	3 days
This commit is contained in:
Pawel Jakub Dawidek 2005-04-08 09:28:08 +00:00
parent 98d0a6938c
commit cdae843174

View File

@ -98,6 +98,10 @@ gctl_error(struct gctl_req *req, const char *fmt, ...)
return (EINVAL);
/* We only record the first error */
if (sbuf_done(req->serror)) {
if (!req->nerror)
req->nerror = EEXIST;
}
if (req->nerror)
return (req->nerror);
@ -107,11 +111,7 @@ gctl_error(struct gctl_req *req, const char *fmt, ...)
sbuf_finish(req->serror);
if (g_debugflags & G_F_CTLDUMP)
printf("gctl %p error \"%s\"\n", req, sbuf_data(req->serror));
req->nerror = copyout(sbuf_data(req->serror), req->error,
imin(req->lerror, sbuf_len(req->serror) + 1));
if (!req->nerror)
req->nerror = EINVAL;
return (req->nerror);
return (0);
}
/*
@ -468,6 +468,10 @@ g_ctl_ioctl_ctl(struct cdev *dev, u_long cmd, caddr_t data, int fflag, struct th
g_waitfor_event(g_ctl_req, req, M_WAITOK, NULL);
gctl_copyout(req);
}
if (sbuf_done(req->serror)) {
req->nerror = copyout(sbuf_data(req->serror), req->error,
imin(req->lerror, sbuf_len(req->serror) + 1));
}
nerror = req->nerror;
gctl_free(req);