diff options
| author | Michael Buesch <mb@bu3sch.de> | 2009-08-01 11:04:19 -0400 |
|---|---|---|
| committer | Len Brown <len.brown@intel.com> | 2009-08-01 23:50:40 -0400 |
| commit | 5b05d4696d38c3172e79e855cc1e2ed044589508 (patch) | |
| tree | 63a23cbb029bd0cac3e7b4f4863f996664afbd26 /drivers/platform | |
| parent | 1f6fc2de9525e34ee93bd392fa046369a8cfbf1e (diff) | |
thinkpad-acpi: restrict procfs count value to sane upper limit
Signed-off-by: Michael Buesch <mb@bu3sch.de>
Acked-by: Henrique de Moraes Holschuh <hmh@hmh.eng.br>
Signed-off-by: Len Brown <len.brown@intel.com>
Diffstat (limited to 'drivers/platform')
| -rw-r--r-- | drivers/platform/x86/thinkpad_acpi.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/drivers/platform/x86/thinkpad_acpi.c b/drivers/platform/x86/thinkpad_acpi.c index 27d68e719e90..18f9ee63c50a 100644 --- a/drivers/platform/x86/thinkpad_acpi.c +++ b/drivers/platform/x86/thinkpad_acpi.c | |||
| @@ -766,6 +766,8 @@ static int dispatch_procfs_write(struct file *file, | |||
| 766 | 766 | ||
| 767 | if (!ibm || !ibm->write) | 767 | if (!ibm || !ibm->write) |
| 768 | return -EINVAL; | 768 | return -EINVAL; |
| 769 | if (count > PAGE_SIZE - 2) | ||
| 770 | return -EINVAL; | ||
| 769 | 771 | ||
| 770 | kernbuf = kmalloc(count + 2, GFP_KERNEL); | 772 | kernbuf = kmalloc(count + 2, GFP_KERNEL); |
| 771 | if (!kernbuf) | 773 | if (!kernbuf) |