mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-10-03 15:47:36 +00:00
ACPI / EC: access user space with get_user()/put_user()
User space pointer may not be dereferenced. Use get_user()/put_user() instead and check their return codes. Signed-off-by: Vasiliy Kulikov <segooon@gmail.com> Signed-off-by: Thomas Renninger <trenn@suse.de> Signed-off-by: Jiri Slaby <jslaby@suse.cz> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
This commit is contained in:
parent
7d13205581
commit
ecde3003e5
1 changed files with 14 additions and 4 deletions
|
@ -12,6 +12,7 @@
|
||||||
#include <linux/acpi.h>
|
#include <linux/acpi.h>
|
||||||
#include <linux/debugfs.h>
|
#include <linux/debugfs.h>
|
||||||
#include <linux/module.h>
|
#include <linux/module.h>
|
||||||
|
#include <linux/uaccess.h>
|
||||||
#include "internal.h"
|
#include "internal.h"
|
||||||
|
|
||||||
MODULE_AUTHOR("Thomas Renninger <trenn@suse.de>");
|
MODULE_AUTHOR("Thomas Renninger <trenn@suse.de>");
|
||||||
|
@ -34,7 +35,6 @@ static ssize_t acpi_ec_read_io(struct file *f, char __user *buf,
|
||||||
* struct acpi_ec *ec = ((struct seq_file *)f->private_data)->private;
|
* struct acpi_ec *ec = ((struct seq_file *)f->private_data)->private;
|
||||||
*/
|
*/
|
||||||
unsigned int size = EC_SPACE_SIZE;
|
unsigned int size = EC_SPACE_SIZE;
|
||||||
u8 *data = (u8 *) buf;
|
|
||||||
loff_t init_off = *off;
|
loff_t init_off = *off;
|
||||||
int err = 0;
|
int err = 0;
|
||||||
|
|
||||||
|
@ -47,9 +47,15 @@ static ssize_t acpi_ec_read_io(struct file *f, char __user *buf,
|
||||||
size = count;
|
size = count;
|
||||||
|
|
||||||
while (size) {
|
while (size) {
|
||||||
err = ec_read(*off, &data[*off - init_off]);
|
u8 byte_read;
|
||||||
|
err = ec_read(*off, &byte_read);
|
||||||
if (err)
|
if (err)
|
||||||
return err;
|
return err;
|
||||||
|
if (put_user(byte_read, buf + *off - init_off)) {
|
||||||
|
if (*off - init_off)
|
||||||
|
return *off - init_off; /* partial read */
|
||||||
|
return -EFAULT;
|
||||||
|
}
|
||||||
*off += 1;
|
*off += 1;
|
||||||
size--;
|
size--;
|
||||||
}
|
}
|
||||||
|
@ -65,7 +71,6 @@ static ssize_t acpi_ec_write_io(struct file *f, const char __user *buf,
|
||||||
|
|
||||||
unsigned int size = count;
|
unsigned int size = count;
|
||||||
loff_t init_off = *off;
|
loff_t init_off = *off;
|
||||||
u8 *data = (u8 *) buf;
|
|
||||||
int err = 0;
|
int err = 0;
|
||||||
|
|
||||||
if (*off >= EC_SPACE_SIZE)
|
if (*off >= EC_SPACE_SIZE)
|
||||||
|
@ -76,7 +81,12 @@ static ssize_t acpi_ec_write_io(struct file *f, const char __user *buf,
|
||||||
}
|
}
|
||||||
|
|
||||||
while (size) {
|
while (size) {
|
||||||
u8 byte_write = data[*off - init_off];
|
u8 byte_write;
|
||||||
|
if (get_user(byte_write, buf + *off - init_off)) {
|
||||||
|
if (*off - init_off)
|
||||||
|
return *off - init_off; /* partial write */
|
||||||
|
return -EFAULT;
|
||||||
|
}
|
||||||
err = ec_write(*off, byte_write);
|
err = ec_write(*off, byte_write);
|
||||||
if (err)
|
if (err)
|
||||||
return err;
|
return err;
|
||||||
|
|
Loading…
Reference in a new issue