Proper way to use copy_to_user?

I'm trying to define a system call that modifies the character buffer passed to it. Specifically, something like this:

...
asmlinkage int sys_mycall( char __user *buff, int len )
{
   char tmp[1000];
   copy_from_user(tmp, buff, len);
   /* change tmp here */
   copy_to_user( buff, &tmp, len );
}

Here, copy_to_user returns -1, and the buffer from the calling program is unchanged. What's happening?

From stackoverflow

• That looks OK. It's possible that the buffer that userspace passed is mapped read-only - for example if it's in the text segment (eg. a string literal). By the way, this is probably what you want:

  return copy_to_user(buff, &tmp, len) ? -EFAULT : 0;
  

  Stefan Kendall : The actual code does do that. I simplified the example to illustrate the core issue.

  Stefan Kendall : I abhor C. Your answer fully solves my problem, but I refuse to admit why.

  Tim Post : I think someone forgot to sign their errno :)

• Remeber that tmp is already a pointer! Correct way to do it:

  copy_to_user( buff, tmp, len );