Skip to content

Commit e2e9080

Browse files
committed
platform/x86: thinkpad_acpi: Revert "Use strndup_user() in dispatch_proc_write()"
This reverts commit 35d13c7. This broke procfs interface due to neglecting the fact that the strings are not coming NULL terminated. Revert the change till we will have a better clean up. Fixes: 35d13c7 ("platform/x86: thinkpad_acpi: Use strndup_user() in dispatch_proc_write()") Reported-by: Hans de Goede <[email protected]> Signed-off-by: Andy Shevchenko <[email protected]>
1 parent b3a9e3b commit e2e9080

File tree

1 file changed

+11
-3
lines changed

1 file changed

+11
-3
lines changed

drivers/platform/x86/thinkpad_acpi.c

Lines changed: 11 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -885,11 +885,19 @@ static ssize_t dispatch_proc_write(struct file *file,
885885

886886
if (!ibm || !ibm->write)
887887
return -EINVAL;
888+
if (count > PAGE_SIZE - 1)
889+
return -EINVAL;
890+
891+
kernbuf = kmalloc(count + 1, GFP_KERNEL);
892+
if (!kernbuf)
893+
return -ENOMEM;
888894

889-
kernbuf = strndup_user(userbuf, PAGE_SIZE);
890-
if (IS_ERR(kernbuf))
891-
return PTR_ERR(kernbuf);
895+
if (copy_from_user(kernbuf, userbuf, count)) {
896+
kfree(kernbuf);
897+
return -EFAULT;
898+
}
892899

900+
kernbuf[count] = 0;
893901
ret = ibm->write(kernbuf);
894902
if (ret == 0)
895903
ret = count;

0 commit comments

Comments
 (0)