On failure get_user() is supposed to zero out the destination variable.
This is documented in the kdoc of the microblaze get_user()
implementation and validated in lib/tests/usercopy_kunit.c.

Currently that zeroing is missing.

Add it.

Fixes: 0d6de9532663 ("microblaze_mmu_v2: uaccess MMU update")
Signed-off-by: Thomas Weißschuh <[email protected]>
---
 arch/microblaze/include/asm/uaccess.h | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/arch/microblaze/include/asm/uaccess.h 
b/arch/microblaze/include/asm/uaccess.h
index afa0dd8d013f..77203af255e5 100644
--- a/arch/microblaze/include/asm/uaccess.h
+++ b/arch/microblaze/include/asm/uaccess.h
@@ -95,7 +95,8 @@ extern long __user_bad(void);
 #define get_user(x, ptr) ({                            \
        const typeof(*(ptr)) __user *__gu_ptr = (ptr);  \
        access_ok(__gu_ptr, sizeof(*__gu_ptr)) ?        \
-               __get_user(x, __gu_ptr) : -EFAULT;      \
+               __get_user(x, __gu_ptr) :               \
+               ((x) = 0, -EFAULT);                     \
 })
 
 #define __get_user(x, ptr)                                             \

-- 
2.55.0


Reply via email to