Commit 0e9d84ea authored by Djalal Harouni's avatar Djalal Harouni Committed by Johannes Berg

iwlwifi: mvm: make debugfs write() operations write up to count bytes

Some debugfs write() operations of the MVM Firmware will ignore the
count argument, and will copy more bytes than what was specified.
Fix this by getting the right count of bytes.

This will honor restrictions put on the number of bytes to write and
avoid strcmp() calls on garbage data.
Signed-off-by: default avatarDjalal Harouni <tixxdz@opendz.org>
Reviewed-by: default avatarEmmanuel Grumbach <emmanuel.grumbach@intel.com>
Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
parent 6a524f48
...@@ -257,7 +257,8 @@ static ssize_t iwl_dbgfs_power_down_allow_write(struct file *file, ...@@ -257,7 +257,8 @@ static ssize_t iwl_dbgfs_power_down_allow_write(struct file *file,
if (!mvm->ucode_loaded) if (!mvm->ucode_loaded)
return -EIO; return -EIO;
if (copy_from_user(buf, user_buf, sizeof(buf))) count = min_t(size_t, count, sizeof(buf) - 1);
if (copy_from_user(buf, user_buf, count))
return -EFAULT; return -EFAULT;
if (sscanf(buf, "%d", &allow) != 1) if (sscanf(buf, "%d", &allow) != 1)
...@@ -281,7 +282,8 @@ static ssize_t iwl_dbgfs_power_down_d3_allow_write(struct file *file, ...@@ -281,7 +282,8 @@ static ssize_t iwl_dbgfs_power_down_d3_allow_write(struct file *file,
char buf[8] = {}; char buf[8] = {};
int allow; int allow;
if (copy_from_user(buf, user_buf, sizeof(buf))) count = min_t(size_t, count, sizeof(buf) - 1);
if (copy_from_user(buf, user_buf, count))
return -EFAULT; return -EFAULT;
if (sscanf(buf, "%d", &allow) != 1) if (sscanf(buf, "%d", &allow) != 1)
...@@ -371,7 +373,8 @@ static ssize_t iwl_dbgfs_pm_params_write(struct file *file, ...@@ -371,7 +373,8 @@ static ssize_t iwl_dbgfs_pm_params_write(struct file *file,
int val; int val;
int ret; int ret;
if (copy_from_user(buf, user_buf, sizeof(buf))) count = min_t(size_t, count, sizeof(buf) - 1);
if (copy_from_user(buf, user_buf, count))
return -EFAULT; return -EFAULT;
if (!strncmp("keep_alive=", buf, 11)) { if (!strncmp("keep_alive=", buf, 11)) {
...@@ -1021,7 +1024,8 @@ static ssize_t iwl_dbgfs_d3_sram_write(struct file *file, ...@@ -1021,7 +1024,8 @@ static ssize_t iwl_dbgfs_d3_sram_write(struct file *file,
char buf[8] = {}; char buf[8] = {};
int store; int store;
if (copy_from_user(buf, user_buf, sizeof(buf))) count = min_t(size_t, count, sizeof(buf) - 1);
if (copy_from_user(buf, user_buf, count))
return -EFAULT; return -EFAULT;
if (sscanf(buf, "%d", &store) != 1) if (sscanf(buf, "%d", &store) != 1)
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment