Commit 71d69e82 authored by Hans de Goede's avatar Hans de Goede

platform/x86: think-lmi: Return EINVAL when kbdlang gets set to a 0 length string

Commit 0ddcf3a6 ("platform/x86: think-lmi: Avoid potential read before
start of the buffer") moved the length == 0 up to before stripping the '\n'
which typically gets added when users echo a value to a sysfs-attribute
from the shell.

This avoids a potential buffer-underrun, but it also causes a behavioral
change, prior to this change "echo > kbdlang", iow writing just a single
'\n' would result in an EINVAL error, but after the change this gets
accepted setting kbdlang to an empty string.

Fix this by replacing the manual '\n' check with using strchrnul() to get
the length till '\n' or terminating 0 in one go; and then do the
length != 0 check after this.

Fixes: 0ddcf3a6 ("platform/x86: think-lmi: Avoid potential read before start of the buffer")
Reported-by: default avatarJuha Leppänen <juha_efku@dnainternet.net>
Suggested-by: default avatarAndy Shevchenko <andy.shevchenko@gmail.com>
Signed-off-by: default avatarHans de Goede <hdegoede@redhat.com>
Link: https://lore.kernel.org/r/20210621193648.44138-1-hdegoede@redhat.com
parent 72fbcac2
...@@ -442,14 +442,9 @@ static ssize_t kbdlang_store(struct kobject *kobj, ...@@ -442,14 +442,9 @@ static ssize_t kbdlang_store(struct kobject *kobj,
struct tlmi_pwd_setting *setting = to_tlmi_pwd_setting(kobj); struct tlmi_pwd_setting *setting = to_tlmi_pwd_setting(kobj);
int length; int length;
length = strlen(buf); /* Calculate length till '\n' or terminating 0 */
if (!length) length = strchrnul(buf, '\n') - buf;
return -EINVAL; if (!length || length >= TLMI_LANG_MAXLEN)
if (buf[length-1] == '\n')
length--;
if (length >= TLMI_LANG_MAXLEN)
return -EINVAL; return -EINVAL;
memcpy(setting->kbdlang, buf, length); memcpy(setting->kbdlang, buf, length);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment