summaryrefslogtreecommitdiffstats
path: root/drivers
diff options
context:
space:
mode:
authorAndy Shevchenko <andriy.shevchenko@linux.intel.com>2020-07-15 12:40:07 +0300
committerAndy Shevchenko <andriy.shevchenko@linux.intel.com>2020-07-15 12:42:52 +0300
commite2e90804dc1c190dcc00e4ca481bfd847ee5efcd (patch)
tree8b4ed30f203d01209ee02c8849f5dee44869e684 /drivers
parentb3a9e3b9622ae10064826dccb4f7a52bd88c7407 (diff)
downloadlinux-e2e90804dc1c190dcc00e4ca481bfd847ee5efcd.tar.bz2
platform/x86: thinkpad_acpi: Revert "Use strndup_user() in dispatch_proc_write()"
This reverts commit 35d13c7a05126a5a54a1ef40aff4c6984474e604. This broke procfs interface due to neglecting the fact that the strings are not coming NULL terminated. Revert the change till we will have a better clean up. Fixes: 35d13c7a0512 ("platform/x86: thinkpad_acpi: Use strndup_user() in dispatch_proc_write()") Reported-by: Hans de Goede <hdegoede@redhat.com> Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Diffstat (limited to 'drivers')
-rw-r--r--drivers/platform/x86/thinkpad_acpi.c14
1 files changed, 11 insertions, 3 deletions
diff --git a/drivers/platform/x86/thinkpad_acpi.c b/drivers/platform/x86/thinkpad_acpi.c
index ff7f0a4f2475..0f6fceda5fc0 100644
--- a/drivers/platform/x86/thinkpad_acpi.c
+++ b/drivers/platform/x86/thinkpad_acpi.c
@@ -885,11 +885,19 @@ static ssize_t dispatch_proc_write(struct file *file,
if (!ibm || !ibm->write)
return -EINVAL;
+ if (count > PAGE_SIZE - 1)
+ return -EINVAL;
+
+ kernbuf = kmalloc(count + 1, GFP_KERNEL);
+ if (!kernbuf)
+ return -ENOMEM;
- kernbuf = strndup_user(userbuf, PAGE_SIZE);
- if (IS_ERR(kernbuf))
- return PTR_ERR(kernbuf);
+ if (copy_from_user(kernbuf, userbuf, count)) {
+ kfree(kernbuf);
+ return -EFAULT;
+ }
+ kernbuf[count] = 0;
ret = ibm->write(kernbuf);
if (ret == 0)
ret = count;