diff options
| author | Andy Shevchenko <andriy.shevchenko@linux.intel.com> | 2020-07-15 12:40:07 +0300 |
|---|---|---|
| committer | Andy Shevchenko <andriy.shevchenko@linux.intel.com> | 2020-07-15 12:45:06 +0300 |
| commit | df11f6c516cdeb98624f4189ab4e00aeeaaaafe6 (patch) | |
| tree | e0da6e0acca1b3b738571689cf781cbe9db8e8db /drivers/platform | |
| parent | 13bceda68fb9ef388ad40d355ab8d03ee64d14c2 (diff) | |
platform/x86: thinkpad_acpi: Revert "Use strndup_user() in dispatch_proc_write()"
This reverts commit 35d13c7a05126a5a54a1ef40aff4c6984474e604.
This broke procfs interface due to neglecting the fact that
the strings are not coming NULL terminated.
Revert the change till we will have a better clean up.
Fixes: 35d13c7a0512 ("platform/x86: thinkpad_acpi: Use strndup_user() in dispatch_proc_write()")
Reported-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Diffstat (limited to 'drivers/platform')
| -rw-r--r-- | drivers/platform/x86/thinkpad_acpi.c | 14 |
1 files changed, 11 insertions, 3 deletions
diff --git a/drivers/platform/x86/thinkpad_acpi.c b/drivers/platform/x86/thinkpad_acpi.c index ff7f0a4f2475..0f6fceda5fc0 100644 --- a/drivers/platform/x86/thinkpad_acpi.c +++ b/drivers/platform/x86/thinkpad_acpi.c @@ -885,11 +885,19 @@ static ssize_t dispatch_proc_write(struct file *file, if (!ibm || !ibm->write) return -EINVAL; + if (count > PAGE_SIZE - 1) + return -EINVAL; + + kernbuf = kmalloc(count + 1, GFP_KERNEL); + if (!kernbuf) + return -ENOMEM; - kernbuf = strndup_user(userbuf, PAGE_SIZE); - if (IS_ERR(kernbuf)) - return PTR_ERR(kernbuf); + if (copy_from_user(kernbuf, userbuf, count)) { + kfree(kernbuf); + return -EFAULT; + } + kernbuf[count] = 0; ret = ibm->write(kernbuf); if (ret == 0) ret = count; |