diff options
| author | Andy Shevchenko <andriy.shevchenko@linux.intel.com> | 2020-07-15 12:40:07 +0300 |
|---|---|---|
| committer | Andy Shevchenko <andriy.shevchenko@linux.intel.com> | 2020-07-15 12:42:52 +0300 |
| commit | e2e90804dc1c190dcc00e4ca481bfd847ee5efcd (patch) | |
| tree | 8b4ed30f203d01209ee02c8849f5dee44869e684 | |
| parent | b3a9e3b9622ae10064826dccb4f7a52bd88c7407 (diff) | |
| download | linux-e2e90804dc1c190dcc00e4ca481bfd847ee5efcd.tar.gz | |
platform/x86: thinkpad_acpi: Revert "Use strndup_user() in dispatch_proc_write()"
This reverts commit 35d13c7a05126a5a54a1ef40aff4c6984474e604.
This broke procfs interface due to neglecting the fact that
the strings are not coming NULL terminated.
Revert the change till we will have a better clean up.
Fixes: 35d13c7a0512 ("platform/x86: thinkpad_acpi: Use strndup_user() in dispatch_proc_write()")
Reported-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
| -rw-r--r-- | drivers/platform/x86/thinkpad_acpi.c | 14 |
1 files changed, 11 insertions, 3 deletions
diff --git a/drivers/platform/x86/thinkpad_acpi.c b/drivers/platform/x86/thinkpad_acpi.c index ff7f0a4f247563..0f6fceda5fc0b6 100644 --- a/drivers/platform/x86/thinkpad_acpi.c +++ b/drivers/platform/x86/thinkpad_acpi.c @@ -885,11 +885,19 @@ static ssize_t dispatch_proc_write(struct file *file, if (!ibm || !ibm->write) return -EINVAL; + if (count > PAGE_SIZE - 1) + return -EINVAL; + + kernbuf = kmalloc(count + 1, GFP_KERNEL); + if (!kernbuf) + return -ENOMEM; - kernbuf = strndup_user(userbuf, PAGE_SIZE); - if (IS_ERR(kernbuf)) - return PTR_ERR(kernbuf); + if (copy_from_user(kernbuf, userbuf, count)) { + kfree(kernbuf); + return -EFAULT; + } + kernbuf[count] = 0; ret = ibm->write(kernbuf); if (ret == 0) ret = count; |