AuxXxilium/linux_dsm_epyc7002
1
0
Fork 0
mirror of https://github.com/AuxXxilium/linux_dsm_epyc7002.git synced 2025-01-14 12:56:09 +07:00
Code Issues Actions Packages Projects Releases Wiki Activity

staging: r8188eu: get a string from the user correctly

Browse Source 
The original code had two bugs:
1) It didn't check if the string was zero length so it could oops when
   it tried to dereference the ZERO_SIZE_PTR.
2) It didn't enforce that the string was NUL terminated.

It was also messy as pants.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Dan Carpenter 2014-10-31 13:40:39 +03:00 committed by Greg Kroah-Hartman
parent f8e4df53c7
commit d0915b2255
1 changed files with 6 additions and 16 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
drivers/staging/rtl8188eu/os_dep/rtw_android.c
View File

@ -162,22 +162,12 @@ int rtw_android_priv_cmd(struct net_device *net, struct ifreq *ifr, int cmd)
ret = -EFAULT;
goto exit;
}
command = kmalloc(priv_cmd.total_len, GFP_KERNEL);
if (!command) {
DBG_88E("%s: failed to allocate memory\n", __func__);
ret = -ENOMEM;
goto exit;
}
if (!access_ok(VERIFY_READ, priv_cmd.buf, priv_cmd.total_len)) {
DBG_88E("%s: failed to access memory\n", __func__);
ret = -EFAULT;
goto exit;
}
if (copy_from_user(command, (char __user *)priv_cmd.buf,
priv_cmd.total_len)) {
ret = -EFAULT;
goto exit;
}
if (priv_cmd.total_len < 1)
return -EINVAL;
command = memdup_user(priv_cmd.buf, priv_cmd.total_len);
if (IS_ERR(command))
return PTR_ERR(command);
command[priv_cmd.total_len - 1] = 0;
DBG_88E("%s: Android private cmd \"%s\" on %s\n",
__func__, command, ifr->ifr_name);
cmd_num = rtw_android_cmdstr_to_num(command);