tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
fork atom

ath5k: debugfs: NULL-terminate strings

Avoid processing garbage data by NULL terminating the strings.

Signed-off-by: Djalal Harouni <tixxdz@opendz.org>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

authored by

Djalal Harouni and committed by
John W. Linville 8aada63c b380a43b

+18 -6
+18 -6
drivers/net/wireless/ath/ath5k/debug.c
··· 245 245 struct ath5k_hw *ah = file->private_data; 246 246 char buf[20]; 247 247 248 - if (copy_from_user(buf, userbuf, min(count, sizeof(buf)))) 248 + count = min_t(size_t, count, sizeof(buf) - 1); 249 + if (copy_from_user(buf, userbuf, count)) 249 250 return -EFAULT; 250 251 252 + buf[count] = '\0'; 251 253 if (strncmp(buf, "disable", 7) == 0) { 252 254 AR5K_REG_DISABLE_BITS(ah, AR5K_BEACON, AR5K_BEACON_ENABLE); 253 255 pr_info("debugfs disable beacons\n"); ··· 347 345 unsigned int i; 348 346 char buf[20]; 349 347 350 - if (copy_from_user(buf, userbuf, min(count, sizeof(buf)))) 348 + count = min_t(size_t, count, sizeof(buf) - 1); 349 + if (copy_from_user(buf, userbuf, count)) 351 350 return -EFAULT; 352 351 352 + buf[count] = '\0'; 353 353 for (i = 0; i < ARRAY_SIZE(dbg_info); i++) { 354 354 if (strncmp(buf, dbg_info[i].name, 355 355 strlen(dbg_info[i].name)) == 0) { ··· 452 448 unsigned int i; 453 449 char buf[20]; 454 450 455 - if (copy_from_user(buf, userbuf, min(count, sizeof(buf)))) 451 + count = min_t(size_t, count, sizeof(buf) - 1); 452 + if (copy_from_user(buf, userbuf, count)) 456 453 return -EFAULT; 457 454 455 + buf[count] = '\0'; 458 456 if (strncmp(buf, "diversity", 9) == 0) { 459 457 ath5k_hw_set_antenna_mode(ah, AR5K_ANTMODE_DEFAULT); 460 458 pr_info("debug: enable diversity\n"); ··· 625 619 struct ath5k_statistics *st = &ah->stats; 626 620 char buf[20]; 627 621 628 - if (copy_from_user(buf, userbuf, min(count, sizeof(buf)))) 622 + count = min_t(size_t, count, sizeof(buf) - 1); 623 + if (copy_from_user(buf, userbuf, count)) 629 624 return -EFAULT; 630 625 626 + buf[count] = '\0'; 631 627 if (strncmp(buf, "clear", 5) == 0) { 632 628 st->rxerr_crc = 0; 633 629 st->rxerr_phy = 0; ··· 774 766 struct ath5k_hw *ah = file->private_data; 775 767 char buf[20]; 776 768 777 - if (copy_from_user(buf, userbuf, min(count, sizeof(buf)))) 769 + count = min_t(size_t, count, sizeof(buf) - 1); 770 + if (copy_from_user(buf, userbuf, count)) 778 771 return -EFAULT; 779 772 773 + buf[count] = '\0'; 780 774 if (strncmp(buf, "sens-low", 8) == 0) { 781 775 ath5k_ani_init(ah, ATH5K_ANI_MODE_MANUAL_HIGH); 782 776 } else if (strncmp(buf, "sens-high", 9) == 0) { ··· 872 862 struct ath5k_hw *ah = file->private_data; 873 863 char buf[20]; 874 864 875 - if (copy_from_user(buf, userbuf, min(count, sizeof(buf)))) 865 + count = min_t(size_t, count, sizeof(buf) - 1); 866 + if (copy_from_user(buf, userbuf, count)) 876 867 return -EFAULT; 877 868 869 + buf[count] = '\0'; 878 870 if (strncmp(buf, "start", 5) == 0) 879 871 ieee80211_wake_queues(ah->hw); 880 872 else if (strncmp(buf, "stop", 4) == 0)