1 files changed, 8 insertions, 2 deletions

diff --git a/net/rfkill/core.c b/net/rfkill/core.c
index 79693fe2001e..47497c97c8d9 100644
--- a/net/rfkill/core.c
+++ b/net/rfkill/core.c
@@ -1076,10 +1076,16 @@ static ssize_t rfkill_fop_write(struct file *file, const char __user *buf,
         struct rfkill_event ev;
 
         /* we don't need the 'hard' variable but accept it */
-        if (count < sizeof(ev) - 1)
+        if (count < RFKILL_EVENT_SIZE_V1 - 1)
                 return -EINVAL;
 
-        if (copy_from_user(&ev, buf, sizeof(ev) - 1))
+        /*
+         * Copy as much data as we can accept into our 'ev' buffer,
+         * but tell userspace how much we've copied so it can determine
+         * our API version even in a write() call, if it cares.
+         */
+        count = min(count, sizeof(ev));
+        if (copy_from_user(&ev, buf, count))
                 return -EFAULT;
 
         if (ev.op != RFKILL_OP_CHANGE && ev.op != RFKILL_OP_CHANGE_ALL)