From mboxrd@z Thu Jan 1 00:00:00 1970 From: Andy Shevchenko Subject: [PATCH v1] platform/x86: thinkpad_acpi: Limit size when call strndup_user() Date: Tue, 14 Jul 2020 13:42:50 +0300 Message-ID: <20200714104250.87970-1-andriy.shevchenko@linux.intel.com> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: ibm-acpi-devel-bounces-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f@public.gmane.org To: Henrique de Moraes Holschuh , ibm-acpi-devel-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f@public.gmane.org, Darren Hart , platform-driver-x86-u79uwXL29TY76Z2rM5mHXA@public.gmane.org Cc: Hans de Goede , Andy Shevchenko List-Id: platform-driver-x86.vger.kernel.org During conversion to use strndup_user() the commit 35d13c7a0512 ("platform/x86: thinkpad_acpi: Use strndup_user() in dispatch_proc_write()") missed the fact that buffer coming thru procfs is not immediately NULL terminated. We have to limit size when calling strndup_user(). Fixes: 35d13c7a0512 ("platform/x86: thinkpad_acpi: Use strndup_user() in dispatch_proc_write()") Reported-by: Hans de Goede Signed-off-by: Andy Shevchenko --- drivers/platform/x86/thinkpad_acpi.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/platform/x86/thinkpad_acpi.c b/drivers/platform/x86/thinkpad_acpi.c index f571d6254e7c..f411ad814cab 100644 --- a/drivers/platform/x86/thinkpad_acpi.c +++ b/drivers/platform/x86/thinkpad_acpi.c @@ -886,7 +886,7 @@ static ssize_t dispatch_proc_write(struct file *file, if (!ibm || !ibm->write) return -EINVAL; - kernbuf = strndup_user(userbuf, PAGE_SIZE); + kernbuf = strndup_user(userbuf, min_t(long, count, PAGE_SIZE)); if (IS_ERR(kernbuf)) return PTR_ERR(kernbuf); -- 2.27.0