Commit 4ac493b1 authored by Al Viro's avatar Al Viro Committed by Linus Torvalds

[PATCH] briq_panel: read() and write() get __user pointers, damnit

annotated, fixed a roothole in ->write().  Dereferencing user-supplied pointer
is a Bad Idea(tm)...
Signed-off-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
Signed-off-by: default avatarLinus Torvalds <torvalds@osdl.org>
parent 2efc80cb
...@@ -87,7 +87,7 @@ static int briq_panel_release(struct inode *ino, struct file *filep) ...@@ -87,7 +87,7 @@ static int briq_panel_release(struct inode *ino, struct file *filep)
return 0; return 0;
} }
static ssize_t briq_panel_read(struct file *file, char *buf, size_t count, static ssize_t briq_panel_read(struct file *file, char __user *buf, size_t count,
loff_t *ppos) loff_t *ppos)
{ {
unsigned short c; unsigned short c;
...@@ -135,7 +135,7 @@ static void scroll_vfd( void ) ...@@ -135,7 +135,7 @@ static void scroll_vfd( void )
vfd_cursor = 20; vfd_cursor = 20;
} }
static ssize_t briq_panel_write(struct file *file, const char *buf, size_t len, static ssize_t briq_panel_write(struct file *file, const char __user *buf, size_t len,
loff_t *ppos) loff_t *ppos)
{ {
size_t indx = len; size_t indx = len;
...@@ -150,19 +150,22 @@ static ssize_t briq_panel_write(struct file *file, const char *buf, size_t len, ...@@ -150,19 +150,22 @@ static ssize_t briq_panel_write(struct file *file, const char *buf, size_t len,
return -EBUSY; return -EBUSY;
for (;;) { for (;;) {
char c;
if (!indx) if (!indx)
break; break;
if (get_user(c, buf))
return -EFAULT;
if (esc) { if (esc) {
set_led(*buf); set_led(c);
esc = 0; esc = 0;
} else if (*buf == 27) { } else if (c == 27) {
esc = 1; esc = 1;
} else if (*buf == 12) { } else if (c == 12) {
/* do a form feed */ /* do a form feed */
for (i=0; i<40; i++) for (i=0; i<40; i++)
vfd[i] = ' '; vfd[i] = ' ';
vfd_cursor = 0; vfd_cursor = 0;
} else if (*buf == 10) { } else if (c == 10) {
if (vfd_cursor < 20) if (vfd_cursor < 20)
vfd_cursor = 20; vfd_cursor = 20;
else if (vfd_cursor < 40) else if (vfd_cursor < 40)
...@@ -175,7 +178,7 @@ static ssize_t briq_panel_write(struct file *file, const char *buf, size_t len, ...@@ -175,7 +178,7 @@ static ssize_t briq_panel_write(struct file *file, const char *buf, size_t len,
/* just a character */ /* just a character */
if (vfd_cursor > 39) if (vfd_cursor > 39)
scroll_vfd(); scroll_vfd();
vfd[vfd_cursor++] = *buf; vfd[vfd_cursor++] = c;
} }
indx--; indx--;
buf++; buf++;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment