aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorAl Viro <viro@ftp.linux.org.uk>2006-09-23 13:20:56 -0400
committerLinus Torvalds <torvalds@g5.osdl.org>2006-09-23 14:34:43 -0400
commit4ac493b1d5bfd332f3dee64baaa620961bab6cdc (patch)
tree276fcdaaad3efc3bbe259a48b2308865b9aefb63
parent2efc80cb8ddc341d81de996920e3b2ad8a12b1f7 (diff)
[PATCH] briq_panel: read() and write() get __user pointers, damnit
annotated, fixed a roothole in ->write(). Dereferencing user-supplied pointer is a Bad Idea(tm)... Signed-off-by: Al Viro <viro@zeniv.linux.org.uk> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
-rw-r--r--drivers/char/briq_panel.c17
1 files changed, 10 insertions, 7 deletions
diff --git a/drivers/char/briq_panel.c b/drivers/char/briq_panel.c
index caae795dd3e7..b8c22255f6ad 100644
--- a/drivers/char/briq_panel.c
+++ b/drivers/char/briq_panel.c
@@ -87,7 +87,7 @@ static int briq_panel_release(struct inode *ino, struct file *filep)
87 return 0; 87 return 0;
88} 88}
89 89
90static ssize_t briq_panel_read(struct file *file, char *buf, size_t count, 90static ssize_t briq_panel_read(struct file *file, char __user *buf, size_t count,
91 loff_t *ppos) 91 loff_t *ppos)
92{ 92{
93 unsigned short c; 93 unsigned short c;
@@ -135,7 +135,7 @@ static void scroll_vfd( void )
135 vfd_cursor = 20; 135 vfd_cursor = 20;
136} 136}
137 137
138static ssize_t briq_panel_write(struct file *file, const char *buf, size_t len, 138static ssize_t briq_panel_write(struct file *file, const char __user *buf, size_t len,
139 loff_t *ppos) 139 loff_t *ppos)
140{ 140{
141 size_t indx = len; 141 size_t indx = len;
@@ -150,19 +150,22 @@ static ssize_t briq_panel_write(struct file *file, const char *buf, size_t len,
150 return -EBUSY; 150 return -EBUSY;
151 151
152 for (;;) { 152 for (;;) {
153 char c;
153 if (!indx) 154 if (!indx)
154 break; 155 break;
156 if (get_user(c, buf))
157 return -EFAULT;
155 if (esc) { 158 if (esc) {
156 set_led(*buf); 159 set_led(c);
157 esc = 0; 160 esc = 0;
158 } else if (*buf == 27) { 161 } else if (c == 27) {
159 esc = 1; 162 esc = 1;
160 } else if (*buf == 12) { 163 } else if (c == 12) {
161 /* do a form feed */ 164 /* do a form feed */
162 for (i=0; i<40; i++) 165 for (i=0; i<40; i++)
163 vfd[i] = ' '; 166 vfd[i] = ' ';
164 vfd_cursor = 0; 167 vfd_cursor = 0;
165 } else if (*buf == 10) { 168 } else if (c == 10) {
166 if (vfd_cursor < 20) 169 if (vfd_cursor < 20)
167 vfd_cursor = 20; 170 vfd_cursor = 20;
168 else if (vfd_cursor < 40) 171 else if (vfd_cursor < 40)
@@ -175,7 +178,7 @@ static ssize_t briq_panel_write(struct file *file, const char *buf, size_t len,
175 /* just a character */ 178 /* just a character */
176 if (vfd_cursor > 39) 179 if (vfd_cursor > 39)
177 scroll_vfd(); 180 scroll_vfd();
178 vfd[vfd_cursor++] = *buf; 181 vfd[vfd_cursor++] = c;
179 } 182 }
180 indx--; 183 indx--;
181 buf++; 184 buf++;