diff options
| author | Dan Carpenter <dan.carpenter@oracle.com> | 2012-09-14 08:11:35 (GMT) |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2012-09-17 12:22:09 (GMT) |
| commit | 82e6bb03983f265d06f2573e48e1cc0ae94d959a (patch) | |
| tree | 57f64f8934e3fe17837dff917665083a8ca3d4d1 /drivers/staging/silicom | |
| parent | e4c536b72fd6b25c7f4f9c6f293f43ba287b8e8f (diff) | |
| download | linux-fsl-qoriq-82e6bb03983f265d06f2573e48e1cc0ae94d959a.tar.xz | |
Staging: silicom: use kstrtoint_from_user()
The main problem with the hand rolled code was that there weren't any
range checks so you could corrupt memory by writing too much data to
the proc file.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Daniel Cotey <puff65537@bansheeslibrary.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers/staging/silicom')
| -rw-r--r-- | drivers/staging/silicom/bp_mod.c | 32 |
1 files changed, 10 insertions, 22 deletions
diff --git a/drivers/staging/silicom/bp_mod.c b/drivers/staging/silicom/bp_mod.c index 1b3f5e7..f138d29 100644 --- a/drivers/staging/silicom/bp_mod.c +++ b/drivers/staging/silicom/bp_mod.c @@ -8071,20 +8071,13 @@ int set_bypass_wd_pfs(struct file *file, const char *buffer, unsigned long count, void *data) { - - char kbuf[256]; bpctl_dev_t *pbp_device_block = (bpctl_dev_t *) data; + int timeout; + int ret; - unsigned int timeout = 0; - char *timeout_ptr = kbuf; - - if (copy_from_user(&kbuf, buffer, count)) { - return -1; - } - - timeout_ptr = kbuf; - timeout = atoi(&timeout_ptr); - + ret = kstrtoint_from_user(buffer, count, 10, &timeout); + if (ret) + return ret; set_bypass_wd_fn(pbp_device_block, timeout); return count; @@ -8712,18 +8705,13 @@ int set_wd_autoreset_pfs(struct file *file, const char *buffer, unsigned long count, void *data) { - char kbuf[256]; bpctl_dev_t *pbp_device_block = (bpctl_dev_t *) data; - u32 timeout = 0; - char *timeout_ptr = kbuf; - - if (copy_from_user(&kbuf, buffer, count)) { - return -1; - } - - timeout_ptr = kbuf; - timeout = atoi(&timeout_ptr); + int timeout; + int ret; + ret = kstrtoint_from_user(buffer, count, 10, &timeout); + if (ret) + return ret; set_wd_autoreset_fn(pbp_device_block, timeout); return count; |