Commit 5c807005 authored by Wei Liu's avatar Wei Liu Committed by David S. Miller

xen-netback: fix debugfs write length check

Enlarge buffer size and check input length properly, so that we don't
misuse -ENOSPC.

Note that command like "kickXXXX" is still allowed, that's one patch for
another day if we really want to be very strict on this.
Reported-by: default avatarSeeChen Ng <seechen81@gmail.com>
Signed-off-by: default avatarWei Liu <wei.liu2@citrix.com>
Cc: Zoltan Kiss <zoltan.kiss@citrix.com>
Cc: Ian Campbell <ian.campbell@citrix.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 490cc7d0
...@@ -116,6 +116,7 @@ static int xenvif_read_io_ring(struct seq_file *m, void *v) ...@@ -116,6 +116,7 @@ static int xenvif_read_io_ring(struct seq_file *m, void *v)
} }
#define XENVIF_KICK_STR "kick" #define XENVIF_KICK_STR "kick"
#define BUFFER_SIZE 32
static ssize_t static ssize_t
xenvif_write_io_ring(struct file *filp, const char __user *buf, size_t count, xenvif_write_io_ring(struct file *filp, const char __user *buf, size_t count,
...@@ -124,22 +125,24 @@ xenvif_write_io_ring(struct file *filp, const char __user *buf, size_t count, ...@@ -124,22 +125,24 @@ xenvif_write_io_ring(struct file *filp, const char __user *buf, size_t count,
struct xenvif_queue *queue = struct xenvif_queue *queue =
((struct seq_file *)filp->private_data)->private; ((struct seq_file *)filp->private_data)->private;
int len; int len;
char write[sizeof(XENVIF_KICK_STR)]; char write[BUFFER_SIZE];
/* don't allow partial writes and check the length */ /* don't allow partial writes and check the length */
if (*ppos != 0) if (*ppos != 0)
return 0; return 0;
if (count < sizeof(XENVIF_KICK_STR) - 1) if (count >= sizeof(write))
return -ENOSPC; return -ENOSPC;
len = simple_write_to_buffer(write, len = simple_write_to_buffer(write,
sizeof(write), sizeof(write) - 1,
ppos, ppos,
buf, buf,
count); count);
if (len < 0) if (len < 0)
return len; return len;
write[len] = '\0';
if (!strncmp(write, XENVIF_KICK_STR, sizeof(XENVIF_KICK_STR) - 1)) if (!strncmp(write, XENVIF_KICK_STR, sizeof(XENVIF_KICK_STR) - 1))
xenvif_interrupt(0, (void *)queue); xenvif_interrupt(0, (void *)queue);
else { else {
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment