Commit e4c536b7 authored by Dan Carpenter's avatar Dan Carpenter Committed by Greg Kroah-Hartman

Staging: silicom: add some range checks to proc functions

If you tried to cat more than 255 characters (the last character is for
the terminator) to these proc files then it would corrupt kernel memory.
Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: default avatarDaniel Cotey <puff65537@bansheeslibrary.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent a09b0278
...@@ -8227,6 +8227,9 @@ set_dis_bypass_pfs(struct file *file, const char *buffer, ...@@ -8227,6 +8227,9 @@ set_dis_bypass_pfs(struct file *file, const char *buffer,
int bypass_param = 0, length = 0; int bypass_param = 0, length = 0;
if (count >= sizeof(kbuf))
return -EINVAL;
if (copy_from_user(&kbuf, buffer, count)) { if (copy_from_user(&kbuf, buffer, count)) {
return -1; return -1;
} }
...@@ -8256,6 +8259,9 @@ set_dis_tap_pfs(struct file *file, const char *buffer, ...@@ -8256,6 +8259,9 @@ set_dis_tap_pfs(struct file *file, const char *buffer,
int tap_param = 0, length = 0; int tap_param = 0, length = 0;
if (count >= sizeof(kbuf))
return -EINVAL;
if (copy_from_user(&kbuf, buffer, count)) { if (copy_from_user(&kbuf, buffer, count)) {
return -1; return -1;
} }
...@@ -8285,6 +8291,9 @@ set_dis_disc_pfs(struct file *file, const char *buffer, ...@@ -8285,6 +8291,9 @@ set_dis_disc_pfs(struct file *file, const char *buffer,
int tap_param = 0, length = 0; int tap_param = 0, length = 0;
if (count >= sizeof(kbuf))
return -EINVAL;
if (copy_from_user(&kbuf, buffer, count)) { if (copy_from_user(&kbuf, buffer, count)) {
return -1; return -1;
} }
...@@ -8374,6 +8383,9 @@ set_bypass_pwup_pfs(struct file *file, const char *buffer, ...@@ -8374,6 +8383,9 @@ set_bypass_pwup_pfs(struct file *file, const char *buffer,
int bypass_param = 0, length = 0; int bypass_param = 0, length = 0;
if (count >= sizeof(kbuf))
return -EINVAL;
if (copy_from_user(&kbuf, buffer, count)) { if (copy_from_user(&kbuf, buffer, count)) {
return -1; return -1;
} }
...@@ -8403,6 +8415,9 @@ set_bypass_pwoff_pfs(struct file *file, const char *buffer, ...@@ -8403,6 +8415,9 @@ set_bypass_pwoff_pfs(struct file *file, const char *buffer,
int bypass_param = 0, length = 0; int bypass_param = 0, length = 0;
if (count >= sizeof(kbuf))
return -EINVAL;
if (copy_from_user(&kbuf, buffer, count)) { if (copy_from_user(&kbuf, buffer, count)) {
return -1; return -1;
} }
...@@ -8432,6 +8447,9 @@ set_tap_pwup_pfs(struct file *file, const char *buffer, ...@@ -8432,6 +8447,9 @@ set_tap_pwup_pfs(struct file *file, const char *buffer,
int tap_param = 0, length = 0; int tap_param = 0, length = 0;
if (count >= sizeof(kbuf))
return -EINVAL;
if (copy_from_user(&kbuf, buffer, count)) { if (copy_from_user(&kbuf, buffer, count)) {
return -1; return -1;
} }
...@@ -8461,6 +8479,9 @@ set_disc_pwup_pfs(struct file *file, const char *buffer, ...@@ -8461,6 +8479,9 @@ set_disc_pwup_pfs(struct file *file, const char *buffer,
int tap_param = 0, length = 0; int tap_param = 0, length = 0;
if (count >= sizeof(kbuf))
return -EINVAL;
if (copy_from_user(&kbuf, buffer, count)) { if (copy_from_user(&kbuf, buffer, count)) {
return -1; return -1;
} }
...@@ -8570,6 +8591,9 @@ set_std_nic_pfs(struct file *file, const char *buffer, ...@@ -8570,6 +8591,9 @@ set_std_nic_pfs(struct file *file, const char *buffer,
int bypass_param = 0, length = 0; int bypass_param = 0, length = 0;
if (count >= sizeof(kbuf))
return -EINVAL;
if (copy_from_user(&kbuf, buffer, count)) { if (copy_from_user(&kbuf, buffer, count)) {
return -1; return -1;
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment