Doug / smarc-fsl-linux-kernel

Download as
Browse Code ยป

Commit d39b7dd1dcbf394a1cb897457c862dafe9a20ac5

Authored by Linus Torvalds
1 parent 91d3f9bacd
Exists in master and in 7 other branches imx_3.0.35_4.1.0, imx_3.10.17_1.0.1_ga, imx_3.10.53_1.1.0_ga, imx_3.14.28_1.0.0_ga, smarc-imx_3.10.53_1.1.0_ga, smarc-imx_3.14.28_1.0.0_ga, smarc-l5.0.0_1.0.0-ga

sgi-gru: decrapfiy options_write() function 

Not a single line of actual code in the function was really
fundamentally correct.

Problems ranged from lack of proper range checking, to removing the last
character written (which admittedly is usually '\n'), to not accepting
hex numbers even though the 'show' routine would show the data in that
format.

This tries to do better.

Acked-by: Michael Buesch <mb@bu3sch.de>
Tested-and-acked-by: Jack Steiner <steiner@sgi.com>
Cc: stable@kernel.org
Cc: Jiri Kosina <jkosina@suse.cz>
Cc: Michael Gilbert <michael.s.gilbert@gmail.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Showing 1 changed file with 7 additions and 6 deletions Side-by-side Diff

drivers/misc/sgi-gru/gruprocfs.c
Diff comments   View file @ d39b7dd
... ... @@ -161,14 +161,15 @@
161 161 static ssize_t options_write(struct file *file, const char __user *userbuf,
162 162 size_t count, loff_t *data)
163 163 {
164   - unsigned long val;
165   - char buf[80];
  164 + char buf[20];
166 165  
167   - if (strncpy_from_user(buf, userbuf, sizeof(buf) - 1) < 0)
  166 + if (count >= sizeof(buf))
  167 + return -EINVAL;
  168 + if (copy_from_user(buf, userbuf, count))
168 169 return -EFAULT;
169   - buf[count - 1] = '\0';
170   - if (!strict_strtoul(buf, 10, &val))
171   - gru_options = val;
  170 + buf[count] = '\0';
  171 + if (strict_strtoul(buf, 0, &gru_options))
  172 + return -EINVAL;
172 173  
173 174 return count;
174 175 }