annotated, fixed a roothole in ->write(). Dereferencing user-supplied pointer
is a Bad Idea(tm)...
Signed-off-by: Al Viro <[email protected]>
---
drivers/char/briq_panel.c | 17 ++++++++++-------
1 files changed, 10 insertions(+), 7 deletions(-)
diff --git a/drivers/char/briq_panel.c b/drivers/char/briq_panel.c
index caae795..b8c2225 100644
--- a/drivers/char/briq_panel.c
+++ b/drivers/char/briq_panel.c
@@ -87,7 +87,7 @@ static int briq_panel_release(struct ino
return 0;
}
-static ssize_t briq_panel_read(struct file *file, char *buf, size_t count,
+static ssize_t briq_panel_read(struct file *file, char __user *buf, size_t count,
loff_t *ppos)
{
unsigned short c;
@@ -135,7 +135,7 @@ static void scroll_vfd( void )
vfd_cursor = 20;
}
-static ssize_t briq_panel_write(struct file *file, const char *buf, size_t len,
+static ssize_t briq_panel_write(struct file *file, const char __user *buf, size_t len,
loff_t *ppos)
{
size_t indx = len;
@@ -150,19 +150,22 @@ #endif
return -EBUSY;
for (;;) {
+ char c;
if (!indx)
break;
+ if (get_user(c, buf))
+ return -EFAULT;
if (esc) {
- set_led(*buf);
+ set_led(c);
esc = 0;
- } else if (*buf == 27) {
+ } else if (c == 27) {
esc = 1;
- } else if (*buf == 12) {
+ } else if (c == 12) {
/* do a form feed */
for (i=0; i<40; i++)
vfd[i] = ' ';
vfd_cursor = 0;
- } else if (*buf == 10) {
+ } else if (c == 10) {
if (vfd_cursor < 20)
vfd_cursor = 20;
else if (vfd_cursor < 40)
@@ -175,7 +178,7 @@ #endif
/* just a character */
if (vfd_cursor > 39)
scroll_vfd();
- vfd[vfd_cursor++] = *buf;
+ vfd[vfd_cursor++] = c;
}
indx--;
buf++;
--
1.4.2.GIT
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[Index of Archives]
[Kernel Newbies]
[Netfilter]
[Bugtraq]
[Photo]
[Stuff]
[Gimp]
[Yosemite News]
[MIPS Linux]
[ARM Linux]
[Linux Security]
[Linux RAID]
[Video 4 Linux]
[Linux for the blind]
[Linux Resources]
