diff options
| author | Vasanthakumar Thiagarajan <vasanth@atheros.com> | 2009-06-02 19:28:55 +0530 |
|---|---|---|
| committer | John W. Linville <linville@tuxdriver.com> | 2009-06-03 14:06:15 -0400 |
| commit | 581f725ccd7e697074aa057fa86bf99b54052c95 (patch) | |
| tree | 38da545a4f3b0af558414a875018579e3dc98832 | |
| parent | 76963bb602ba91927130a0140d5757a5969e08ac (diff) | |
| download | linux-581f725ccd7e697074aa057fa86bf99b54052c95.tar.bz2 | |
ath9k: Fix write callback of 'debug' which configures debug mask
Handle error condition on copy_from_user() properly and
make sure a NUL terminated char[] is sent to strict_strtoul()
for proper conversion.
Signed-off-by: Vasanthakumar Thiagarajan <vasanth@atheros.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
| -rw-r--r-- | drivers/net/wireless/ath/ath9k/debug.c | 22 |
1 files changed, 14 insertions, 8 deletions
diff --git a/drivers/net/wireless/ath/ath9k/debug.c b/drivers/net/wireless/ath/ath9k/debug.c index a42d631e7456..6d20725d6451 100644 --- a/drivers/net/wireless/ath/ath9k/debug.c +++ b/drivers/net/wireless/ath/ath9k/debug.c @@ -49,8 +49,9 @@ static ssize_t read_file_debug(struct file *file, char __user *user_buf, { struct ath_softc *sc = file->private_data; char buf[32]; - unsigned int len = 0; - len += snprintf(buf, sizeof(buf), "0x%08x\n", sc->debug.debug_mask); + unsigned int len; + + len = snprintf(buf, sizeof(buf), "0x%08x\n", sc->debug.debug_mask); return simple_read_from_buffer(user_buf, count, ppos, buf, len); } @@ -60,12 +61,17 @@ static ssize_t write_file_debug(struct file *file, const char __user *user_buf, struct ath_softc *sc = file->private_data; unsigned long mask; char buf[32]; - if (copy_from_user(buf, user_buf, (sizeof(buf) - 1) < count ? - (sizeof(buf) - 1) : count)) - return 0; - buf[sizeof(buf)-1] = 0; - if (strict_strtoul(buf, 0, &mask) == 0) - sc->debug.debug_mask = mask; + ssize_t len; + + len = min(count, sizeof(buf) - 1); + if (copy_from_user(buf, user_buf, len)) + return -EINVAL; + + buf[len] = '\0'; + if (strict_strtoul(buf, 0, &mask)) + return -EINVAL; + + sc->debug.debug_mask = mask; return count; } |