1 files changed, 229 insertions, 161 deletions

diff --git a/kernel/sysctl.c b/kernel/sysctl.c
index 8686b0f5fc12..4a976208de29 100644
--- a/kernel/sysctl.c
+++ b/kernel/sysctl.c
@@ -2040,8 +2040,122 @@ int proc_dostring(struct ctl_table *table, int write,
                                buffer, lenp, ppos);
 }
 
+static size_t proc_skip_spaces(char **buf)
+{
+        size_t ret;
+        char *tmp = skip_spaces(*buf);
+        ret = tmp - *buf;
+        *buf = tmp;
+        return ret;
+}
+
+#define TMPBUFLEN 22
+/**
+ * proc_get_long - reads an ASCII formated integer from a user buffer
+ *
+ * @buf - a kernel buffer
+ * @size - size of the kernel buffer
+ * @val - this is where the number will be stored
+ * @neg - set to %TRUE if number is negative
+ * @perm_tr - a vector which contains the allowed trailers
+ * @perm_tr_len - size of the perm_tr vector
+ * @tr - pointer to store the trailer character
+ *
+ * In case of success 0 is returned and buf and size are updated with
+ * the amount of bytes read. If tr is non NULL and a trailing
+ * character exist (size is non zero after returning from this
+ * function) tr is updated with the trailing character.
+ */
+static int proc_get_long(char **buf, size_t *size,
+                          unsigned long *val, bool *neg,
+                          const char *perm_tr, unsigned perm_tr_len, char *tr)
+{
+        int len;
+        char *p, tmp[TMPBUFLEN];
+
+        if (!*size)
+                return -EINVAL;
+
+        len = *size;
+        if (len > TMPBUFLEN - 1)
+                len = TMPBUFLEN - 1;
+
+        memcpy(tmp, *buf, len);
+
+        tmp[len] = 0;
+        p = tmp;
+        if (*p == '-' && *size > 1) {
+                *neg = true;
+                p++;
+        } else
+                *neg = false;
+        if (!isdigit(*p))
+                return -EINVAL;
+
+        *val = simple_strtoul(p, &p, 0);
+
+        len = p - tmp;
+
+        /* We don't know if the next char is whitespace thus we may accept
+         * invalid integers (e.g. 1234...a) or two integers instead of one
+         * (e.g. 123...1). So lets not allow such large numbers. */
+        if (len == TMPBUFLEN - 1)
+                return -EINVAL;
+
+        if (len < *size && perm_tr_len && !memchr(perm_tr, *p, perm_tr_len))
+                return -EINVAL;
 
-static int do_proc_dointvec_conv(int *negp, unsigned long *lvalp,
+        if (tr && (len < *size))
+                *tr = *p;
+
+        *buf += len;
+        *size -= len;
+
+        return 0;
+}
+
+/**
+ * proc_put_long - coverts an integer to a decimal ASCII formated string
+ *
+ * @buf - the user buffer
+ * @size - the size of the user buffer
+ * @val - the integer to be converted
+ * @neg - sign of the number, %TRUE for negative
+ *
+ * In case of success 0 is returned and buf and size are updated with
+ * the amount of bytes read.
+ */
+static int proc_put_long(void __user **buf, size_t *size, unsigned long val,
+                          bool neg)
+{
+        int len;
+        char tmp[TMPBUFLEN], *p = tmp;
+
+        sprintf(p, "%s%lu", neg ? "-" : "", val);
+        len = strlen(tmp);
+        if (len > *size)
+                len = *size;
+        if (copy_to_user(*buf, tmp, len))
+                return -EFAULT;
+        *size -= len;
+        *buf += len;
+        return 0;
+}
+#undef TMPBUFLEN
+
+static int proc_put_char(void __user **buf, size_t *size, char c)
+{
+        if (*size) {
+                char __user **buffer = (char __user **)buf;
+                if (put_user(c, *buffer))
+                        return -EFAULT;
+                (*size)--, (*buffer)++;
+                *buf = *buffer;
+        }
+        return 0;
+}
+
+static int do_proc_dointvec_conv(bool *negp, unsigned long *lvalp,
                                  int *valp,
                                  int write, void *data)
 {
@@ -2050,33 +2164,31 @@ static int do_proc_dointvec_conv(int *negp, unsigned long *lvalp,
         } else {
                 int val = *valp;
                 if (val < 0) {
-                        *negp = -1;
+                        *negp = true;
                         *lvalp = (unsigned long)-val;
                 } else {
-                        *negp = 0;
+                        *negp = false;
                         *lvalp = (unsigned long)val;
                 }
         }
         return 0;
 }
 
+static const char proc_wspace_sep[] = { ' ', '\t', '\n' };
+
 static int __do_proc_dointvec(void *tbl_data, struct ctl_table *table,
                   int write, void __user *buffer,
                   size_t *lenp, loff_t *ppos,
-                  int (*conv)(int *negp, unsigned long *lvalp, int *valp,
+                  int (*conv)(bool *negp, unsigned long *lvalp, int *valp,
                               int write, void *data),
                   void *data)
 {
-#define TMPBUFLEN 21
-        int *i, vleft, first = 1, neg;
-        unsigned long lval;
-        size_t left, len;
-        
-        char buf[TMPBUFLEN], *p;
-        char __user *s = buffer;
+        int *i, vleft, first = 1, err = 0;
+        unsigned long page = 0;
+        size_t left;
+        char *kbuf;
         
-        if (!tbl_data || !table->maxlen || !*lenp ||
-            (*ppos && !write)) {
+        if (!tbl_data || !table->maxlen || !*lenp || (*ppos && !write)) {
                 *lenp = 0;
                 return 0;
         }
@@ -2088,89 +2200,69 @@ static int __do_proc_dointvec(void *tbl_data, struct ctl_table *table,
         if (!conv)
                 conv = do_proc_dointvec_conv;
 
+        if (write) {
+                if (left > PAGE_SIZE - 1)
+                        left = PAGE_SIZE - 1;
+                page = __get_free_page(GFP_TEMPORARY);
+                kbuf = (char *) page;
+                if (!kbuf)
+                        return -ENOMEM;
+                if (copy_from_user(kbuf, buffer, left)) {
+                        err = -EFAULT;
+                        goto free;
+                }
+                kbuf[left] = 0;
+        }
+
         for (; left && vleft--; i++, first=0) {
-                if (write) {
-                        while (left) {
-                                char c;
-                                if (get_user(c, s))
-                                        return -EFAULT;
-                                if (!isspace(c))
-                                        break;
-                                left--;
+                unsigned long lval;
+                bool neg;