Question

I was trying to use copy_to_user in kernel module read function, but am not able to copy the data from kernel to user buffer. Please can anyone tell me if I am doing some mistake. My kernel version is 2.6.35. I am giving the portion of kernel module as well as the application being used to test it. Right now my focus is why this copy_to_user is not working. Any help will great.

///////////////////////////////////kernel module//////////////////////////////////////

#define BUF_LEN 80

static char msg[BUF_LEN];       
static char *msg_Ptr;

static int device_open(struct inode *inode, struct file *file)
{
static int counter = 0;

if (Device_Open)
    return -EBUSY;

Device_Open++;
printk(KERN_ALERT "In open device call\n");

sprintf(msg, "I already told you %d times Hello world!\n", counter++);
msg_Ptr = msg;
try_module_get(THIS_MODULE);

return SUCCESS;
}


static ssize_t device_read(struct file *filp,    
           char __user *buffer,    
           size_t length,    
           loff_t * offset)
{
/*
 * Number of bytes actually written to the buffer 
 */
int bytes_read = 0;

/*
 * If we are at the end of the message, 
 * return 0 signifying end of file 
 */
if (*msg_Ptr == 0)
    return 0;

/* 
 * Actually put the data into the buffer 
 */


else {
    bytes_read=copy_to_user(buffer, msg, length);
    if (bytes_read==-1);
        {
         printk(KERN_INFO "Error in else while copying the data \n");
        }

    }

   return bytes_read;
}






////////////////////////////////////////application////////////////////////
#include <stdio.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h> 
#include <stdlib.h>

#define  BUF_SIZE    40

int main()
{
ssize_t num_bytes;
int fd, n=0;
char buf[BUF_SIZE];

fd=open("/dev/chardev", O_RDWR);
if(fd== -1){perror("Error while opening device");exit(1);}

printf("fd=%d\n",fd);
num_bytes=read(fd, buf, BUF_SIZE);
if(num_bytes==-1){perror("Error while reading"); exit(2);}

printf("The value fetched is %lu bytes\n", num_bytes);

while(n<=num_bytes)
    {
        printf("%c",buf[n]);
        n++;
    }

close(fd);
return 0;

}

Answer 1

There are a few problems in the code snippet you wrote. First of all, it is not a good thing to make the call try_module_get(THIS_MODULE);
This statement tries to increase the refcount of the module … in the module itself ! Instead, you should set the owner field of the file_ops structure to THIS_MODULE in your init method. This way, the reference handling will happen outside the module code, in the VFS layer. You might take a look at Linux Kernel Modules: When to use try_module_get / module_put.
Then, as it was stated by Vineet you should retrieve the pointer from the file_ops private_data field.

And last but not least, here is the reason why it seems an error happened while … Actually … It did not :
The copy_to_user call returns 0 if it has successfully copied all the desired bytes into the destination memory area and a strictly positive value stating the number of bytes that were NOT copied in case of error. That said, when you run :

/* Kernel part */
bytes_read=copy_to_user(buffer, msg, length);
/* 
 * Wrong error checking :
 * In the below statement, "-1" is viewed as an unsigned long.
 * With a simple equality test, this will not bother you
 * But this is dangerous with other comparisons like "<" or ">"
 * (unsigned long)(-1) is at least 2^32 - 1 so ...
 */
if (-1 == bytes_read) {
    /* etc. */
}
return bytes_read;

/* App part */
num_bytes=read(fd, buf, BUF_SIZE);
/* etc.. */
while(n<=num_bytes) {
    printf("%c",buf[n]);
    n++;
}

You should only get one character upon a successful copy, that is only a single “I” in your case.
Moreover, you use your msg_Ptr pointer as a safeguard but you never update it. This might result in a wrong call to copy_to_user.
copy_to_user checks the user-space pointer with a call to access_ok, but if the kernel-space pointer and the given length are not allright, this might end in a Kernel Oops/Panic.