All of lore.kernel.org
 help / color / mirror / Atom feed
From: Dan Carpenter <dan.carpenter@oracle.com>
To: Kalle Valo <kvalo@kernel.org>, Jiri Slaby <jirislaby@kernel.org>
Cc: Paolo Abeni <pabeni@redhat.com>,
	Johannes Berg <johannes.berg@intel.com>,
	linux-wireless@vger.kernel.org, kernel-janitors@vger.kernel.org
Subject: [PATCH 2/2] wil6210: debugfs: replace in wil_link_stats_write() in wil_link_stats_write()
Date: Wed, 6 Jul 2022 09:57:57 +0300	[thread overview]
Message-ID: <YsUydUx6FEz1ETq5@kili> (raw)
In-Reply-To: <YsUx6tbR5jhJc/UH@kili>

This code has a check for "if (rc != len) {" so it will fail if the
simple_write_to_buffer() does not completely fill the buffer.  In
particular it will fail if "*ppos != 0". Although this code works, it is
more complicated than necessary.  Just use strndup_user() instead.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
---
 drivers/net/wireless/ath/wil6210/debugfs.c | 15 ++++++---------
 1 file changed, 6 insertions(+), 9 deletions(-)

diff --git a/drivers/net/wireless/ath/wil6210/debugfs.c b/drivers/net/wireless/ath/wil6210/debugfs.c
index fe84362718de..591ba7f61c64 100644
--- a/drivers/net/wireless/ath/wil6210/debugfs.c
+++ b/drivers/net/wireless/ath/wil6210/debugfs.c
@@ -1937,18 +1937,15 @@ static ssize_t wil_link_stats_write(struct file *file, const char __user *buf,
 	struct wil6210_priv *wil = s->private;
 	int cid, interval, rc, i;
 	struct wil6210_vif *vif;
-	char *kbuf = kmalloc(len + 1, GFP_KERNEL);
+	char *kbuf;
 
-	if (!kbuf)
-		return -ENOMEM;
+	if (*ppos != 0)
+		return -EINVAL;
 
-	rc = simple_write_to_buffer(kbuf, len, ppos, buf, len);
-	if (rc != len) {
-		kfree(kbuf);
-		return rc >= 0 ? -EIO : rc;
-	}
+	kbuf = strndup_user(buf, len + 1);
+	if (IS_ERR(kbuf))
+		return -ENOMEM;
 
-	kbuf[len] = '\0';
 	/* specify cid (use -1 for all cids) and snapshot interval in ms */
 	rc = sscanf(kbuf, "%d %d", &cid, &interval);
 	kfree(kbuf);
-- 
2.35.1


  reply	other threads:[~2022-07-06  6:58 UTC|newest]

Thread overview: 4+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2022-07-06  6:55 [PATCH 1/2] wil6210: debugfs: fix info leak in wil_write_file_wmi() Dan Carpenter
2022-07-06  6:57 ` Dan Carpenter [this message]
2022-07-06 10:39   ` [PATCH 2/2] wil6210: debugfs: replace in wil_link_stats_write() in wil_link_stats_write() Dan Carpenter
2022-07-10 13:04 ` [PATCH 1/2] wil6210: debugfs: fix info leak in wil_write_file_wmi() kernel test robot

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=YsUydUx6FEz1ETq5@kili \
    --to=dan.carpenter@oracle.com \
    --cc=jirislaby@kernel.org \
    --cc=johannes.berg@intel.com \
    --cc=kernel-janitors@vger.kernel.org \
    --cc=kvalo@kernel.org \
    --cc=linux-wireless@vger.kernel.org \
    --cc=pabeni@redhat.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.