Re: copy_from_user returns a positive value?

David S. Miller (
Fri, 15 Feb 2002 15:24:55 -0800 (PST)

From: Ben Greear <>
Date: Thu, 14 Feb 2002 19:10:20 -0700

When I make the copy from user call:

if ((ret = copy_from_user(&reqconf, arg, sizeof(reqconf)))) {
printk("ERROR: copy_from_user returned: %i, sizeof(reqconf): %i\n",
ret, sizeof(reqconf));
return ret;

I see this printed out:

ERROR: copy_from_user returned: 696, sizeof(reqconf): 696


1) 'arg' is a bogus userland pointer


2) 'arg' is a valid userland pointer, but someone has done a
set_fs(KERNEL_DS) so only kernel pointers are valid for user

A lot of the "32-bit userland on 64-bit kernel" compatability laters
work by doing #2. They munge the 32-bit user structures into kernel
side copies, and do set_fs(KERNEL_DS) and pass in the pointers to the
kernel copies to the real syscall then finally restore things back to

copy_{to,from}_user always return, as you correctly noted, the amount
of data that could not be copied or "0" for success. That is why all
code does something like this:

err = 0;
if (copy_{to,from}_user(...))
err = -EFAULT;

I don't know where some people get the idea that copy_{to,from}_user
should return -EFAULT on failure. Maybe some port is buggy :-)
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to
More majordomo info at
Please read the FAQ at