From 0e9d84ea89a588a6ed7b4e9809cd4a8af0bb6a88 Mon Sep 17 00:00:00 2001 From: Djalal Harouni Date: Sat, 24 Aug 2013 14:35:53 +0100 Subject: [PATCH] iwlwifi: mvm: make debugfs write() operations write up to count bytes Some debugfs write() operations of the MVM Firmware will ignore the count argument, and will copy more bytes than what was specified. Fix this by getting the right count of bytes. This will honor restrictions put on the number of bytes to write and avoid strcmp() calls on garbage data. Signed-off-by: Djalal Harouni Reviewed-by: Emmanuel Grumbach Signed-off-by: Johannes Berg --- drivers/net/wireless/iwlwifi/mvm/debugfs.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/drivers/net/wireless/iwlwifi/mvm/debugfs.c b/drivers/net/wireless/iwlwifi/mvm/debugfs.c index 1e9e6f3..26c53b3 100644 --- a/drivers/net/wireless/iwlwifi/mvm/debugfs.c +++ b/drivers/net/wireless/iwlwifi/mvm/debugfs.c @@ -257,7 +257,8 @@ static ssize_t iwl_dbgfs_power_down_allow_write(struct file *file, if (!mvm->ucode_loaded) return -EIO; - if (copy_from_user(buf, user_buf, sizeof(buf))) + count = min_t(size_t, count, sizeof(buf) - 1); + if (copy_from_user(buf, user_buf, count)) return -EFAULT; if (sscanf(buf, "%d", &allow) != 1) @@ -281,7 +282,8 @@ static ssize_t iwl_dbgfs_power_down_d3_allow_write(struct file *file, char buf[8] = {}; int allow; - if (copy_from_user(buf, user_buf, sizeof(buf))) + count = min_t(size_t, count, sizeof(buf) - 1); + if (copy_from_user(buf, user_buf, count)) return -EFAULT; if (sscanf(buf, "%d", &allow) != 1) @@ -371,7 +373,8 @@ static ssize_t iwl_dbgfs_pm_params_write(struct file *file, int val; int ret; - if (copy_from_user(buf, user_buf, sizeof(buf))) + count = min_t(size_t, count, sizeof(buf) - 1); + if (copy_from_user(buf, user_buf, count)) return -EFAULT; if (!strncmp("keep_alive=", buf, 11)) { @@ -1021,7 +1024,8 @@ static ssize_t iwl_dbgfs_d3_sram_write(struct file *file, char buf[8] = {}; int store; - if (copy_from_user(buf, user_buf, sizeof(buf))) + count = min_t(size_t, count, sizeof(buf) - 1); + if (copy_from_user(buf, user_buf, count)) return -EFAULT; if (sscanf(buf, "%d", &store) != 1) -- 2.7.4