fs/pipe.c: return error code rather than 0 in pipe_write()

pipe_write() would return 0 if it failed to merge the beginning of the
data to write with the last, partially filled pipe buffer.  It should
return an error code instead.  Userspace programs could be confused by
write() returning 0 when called with a nonzero 'count'.

The EFAULT error case was a regression from f0d1bec9d5 ("new helper:
copy_page_from_iter()"), while the ops->confirm() error case was a much
older bug.

Test program:

	#include <assert.h>
	#include <errno.h>
	#include <unistd.h>

	int main(void)
	{
		int fd[2];
		char data[1] = {0};

		assert(0 == pipe(fd));
		assert(1 == write(fd[1], data, 1));

		/* prior to this patch, write() returned 0 here  */
		assert(-1 == write(fd[1], NULL, 1));
		assert(errno == EFAULT);
	}

Cc: stable@vger.kernel.org # at least v3.15+
Signed-off-by: Eric Biggers <ebiggers3@gmail.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>

diff --git a/fs/pipe.c b/fs/pipe.c
index 997de34644795e34094d6f1f08d060f845a84db1..42cf8ddf0e5599da6621fcdf741d6a61fd2f2d7a 100644 (file)
--- a/fs/pipe.c
+++ b/fs/pipe.c
@@ -366,18 +366,17 @@ pipe_write(struct kiocb *iocb, struct iov_iter *from)
                int offset = buf->offset + buf->len;
 
                if (ops->can_merge && offset + chars <= PAGE_SIZE) {
-                       int error = ops->confirm(pipe, buf);
-                       if (error)
+                       ret = ops->confirm(pipe, buf);
+                       if (ret)
                                goto out;
 
                        ret = copy_page_from_iter(buf->page, offset, chars, from);
                        if (unlikely(ret < chars)) {
-                               error = -EFAULT;
+                               ret = -EFAULT;
                                goto out;
                        }
                        do_wakeup = 1;
-                       buf->len += chars;
-                       ret = chars;
+                       buf->len += ret;
                        if (!iov_iter_count(from))
                                goto out;
                }