From: Andy Shevchenko <andriy.shevchenko-VuQAYsv1563Yd54FQh9/CA@public.gmane.org>
To: Henrique de Moraes Holschuh
<ibm-acpi-N3TV7GIv+o9fyO9Q7EP/yw@public.gmane.org>,
ibm-acpi-devel-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f@public.gmane.org,
Darren Hart <dvhart-wEGCiKHe2LqWVfeAwA7xHQ@public.gmane.org>,
platform-driver-x86-u79uwXL29TY76Z2rM5mHXA@public.gmane.org
Cc: Hans de Goede <hdegoede-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org>,
Andy Shevchenko
<andriy.shevchenko-VuQAYsv1563Yd54FQh9/CA@public.gmane.org>
Subject: [PATCH v1] platform/x86: thinkpad_acpi: Limit size when call strndup_user()
Date: Tue, 14 Jul 2020 13:42:50 +0300 [thread overview]
Message-ID: <20200714104250.87970-1-andriy.shevchenko@linux.intel.com> (raw)
During conversion to use strndup_user() the commit 35d13c7a0512
("platform/x86: thinkpad_acpi: Use strndup_user() in dispatch_proc_write()")
missed the fact that buffer coming thru procfs is not immediately NULL
terminated. We have to limit size when calling strndup_user().
Fixes: 35d13c7a0512 ("platform/x86: thinkpad_acpi: Use strndup_user() in dispatch_proc_write()")
Reported-by: Hans de Goede <hdegoede-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org>
Signed-off-by: Andy Shevchenko <andriy.shevchenko-VuQAYsv1563Yd54FQh9/CA@public.gmane.org>
---
drivers/platform/x86/thinkpad_acpi.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/platform/x86/thinkpad_acpi.c b/drivers/platform/x86/thinkpad_acpi.c
index f571d6254e7c..f411ad814cab 100644
--- a/drivers/platform/x86/thinkpad_acpi.c
+++ b/drivers/platform/x86/thinkpad_acpi.c
@@ -886,7 +886,7 @@ static ssize_t dispatch_proc_write(struct file *file,
if (!ibm || !ibm->write)
return -EINVAL;
- kernbuf = strndup_user(userbuf, PAGE_SIZE);
+ kernbuf = strndup_user(userbuf, min_t(long, count, PAGE_SIZE));
if (IS_ERR(kernbuf))
return PTR_ERR(kernbuf);
--
2.27.0
next reply other threads:[~2020-07-14 10:42 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-07-14 10:42 Andy Shevchenko [this message]
[not found] ` <20200714104250.87970-1-andriy.shevchenko-VuQAYsv1563Yd54FQh9/CA@public.gmane.org>
2020-07-14 13:29 ` [PATCH v1] platform/x86: thinkpad_acpi: Limit size when call strndup_user() Hans de Goede
[not found] ` <6920cff7-ab7c-a4ef-4f8f-83966b7bf498-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org>
2020-07-15 10:06 ` Andy Shevchenko
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200714104250.87970-1-andriy.shevchenko@linux.intel.com \
--to=andriy.shevchenko-vuqaysv1563yd54fqh9/ca@public.gmane.org \
--cc=dvhart-wEGCiKHe2LqWVfeAwA7xHQ@public.gmane.org \
--cc=hdegoede-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org \
--cc=ibm-acpi-N3TV7GIv+o9fyO9Q7EP/yw@public.gmane.org \
--cc=ibm-acpi-devel-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f@public.gmane.org \
--cc=platform-driver-x86-u79uwXL29TY76Z2rM5mHXA@public.gmane.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox