提交 8aada63c 编写于 作者: D Djalal Harouni 提交者: John W. Linville

ath5k: debugfs: NULL-terminate strings

Avoid processing garbage data by NULL terminating the strings.
Signed-off-by: NDjalal Harouni <tixxdz@opendz.org>
Signed-off-by: NJohn W. Linville <linville@tuxdriver.com>
上级 b380a43b
...@@ -245,9 +245,11 @@ static ssize_t write_file_beacon(struct file *file, ...@@ -245,9 +245,11 @@ static ssize_t write_file_beacon(struct file *file,
struct ath5k_hw *ah = file->private_data; struct ath5k_hw *ah = file->private_data;
char buf[20]; char buf[20];
if (copy_from_user(buf, userbuf, min(count, sizeof(buf)))) count = min_t(size_t, count, sizeof(buf) - 1);
if (copy_from_user(buf, userbuf, count))
return -EFAULT; return -EFAULT;
buf[count] = '\0';
if (strncmp(buf, "disable", 7) == 0) { if (strncmp(buf, "disable", 7) == 0) {
AR5K_REG_DISABLE_BITS(ah, AR5K_BEACON, AR5K_BEACON_ENABLE); AR5K_REG_DISABLE_BITS(ah, AR5K_BEACON, AR5K_BEACON_ENABLE);
pr_info("debugfs disable beacons\n"); pr_info("debugfs disable beacons\n");
...@@ -345,9 +347,11 @@ static ssize_t write_file_debug(struct file *file, ...@@ -345,9 +347,11 @@ static ssize_t write_file_debug(struct file *file,
unsigned int i; unsigned int i;
char buf[20]; char buf[20];
if (copy_from_user(buf, userbuf, min(count, sizeof(buf)))) count = min_t(size_t, count, sizeof(buf) - 1);
if (copy_from_user(buf, userbuf, count))
return -EFAULT; return -EFAULT;
buf[count] = '\0';
for (i = 0; i < ARRAY_SIZE(dbg_info); i++) { for (i = 0; i < ARRAY_SIZE(dbg_info); i++) {
if (strncmp(buf, dbg_info[i].name, if (strncmp(buf, dbg_info[i].name,
strlen(dbg_info[i].name)) == 0) { strlen(dbg_info[i].name)) == 0) {
...@@ -448,9 +452,11 @@ static ssize_t write_file_antenna(struct file *file, ...@@ -448,9 +452,11 @@ static ssize_t write_file_antenna(struct file *file,
unsigned int i; unsigned int i;
char buf[20]; char buf[20];
if (copy_from_user(buf, userbuf, min(count, sizeof(buf)))) count = min_t(size_t, count, sizeof(buf) - 1);
if (copy_from_user(buf, userbuf, count))
return -EFAULT; return -EFAULT;
buf[count] = '\0';
if (strncmp(buf, "diversity", 9) == 0) { if (strncmp(buf, "diversity", 9) == 0) {
ath5k_hw_set_antenna_mode(ah, AR5K_ANTMODE_DEFAULT); ath5k_hw_set_antenna_mode(ah, AR5K_ANTMODE_DEFAULT);
pr_info("debug: enable diversity\n"); pr_info("debug: enable diversity\n");
...@@ -619,9 +625,11 @@ static ssize_t write_file_frameerrors(struct file *file, ...@@ -619,9 +625,11 @@ static ssize_t write_file_frameerrors(struct file *file,
struct ath5k_statistics *st = &ah->stats; struct ath5k_statistics *st = &ah->stats;
char buf[20]; char buf[20];
if (copy_from_user(buf, userbuf, min(count, sizeof(buf)))) count = min_t(size_t, count, sizeof(buf) - 1);
if (copy_from_user(buf, userbuf, count))
return -EFAULT; return -EFAULT;
buf[count] = '\0';
if (strncmp(buf, "clear", 5) == 0) { if (strncmp(buf, "clear", 5) == 0) {
st->rxerr_crc = 0; st->rxerr_crc = 0;
st->rxerr_phy = 0; st->rxerr_phy = 0;
...@@ -766,9 +774,11 @@ static ssize_t write_file_ani(struct file *file, ...@@ -766,9 +774,11 @@ static ssize_t write_file_ani(struct file *file,
struct ath5k_hw *ah = file->private_data; struct ath5k_hw *ah = file->private_data;
char buf[20]; char buf[20];
if (copy_from_user(buf, userbuf, min(count, sizeof(buf)))) count = min_t(size_t, count, sizeof(buf) - 1);
if (copy_from_user(buf, userbuf, count))
return -EFAULT; return -EFAULT;
buf[count] = '\0';
if (strncmp(buf, "sens-low", 8) == 0) { if (strncmp(buf, "sens-low", 8) == 0) {
ath5k_ani_init(ah, ATH5K_ANI_MODE_MANUAL_HIGH); ath5k_ani_init(ah, ATH5K_ANI_MODE_MANUAL_HIGH);
} else if (strncmp(buf, "sens-high", 9) == 0) { } else if (strncmp(buf, "sens-high", 9) == 0) {
...@@ -862,9 +872,11 @@ static ssize_t write_file_queue(struct file *file, ...@@ -862,9 +872,11 @@ static ssize_t write_file_queue(struct file *file,
struct ath5k_hw *ah = file->private_data; struct ath5k_hw *ah = file->private_data;
char buf[20]; char buf[20];
if (copy_from_user(buf, userbuf, min(count, sizeof(buf)))) count = min_t(size_t, count, sizeof(buf) - 1);
if (copy_from_user(buf, userbuf, count))
return -EFAULT; return -EFAULT;
buf[count] = '\0';
if (strncmp(buf, "start", 5) == 0) if (strncmp(buf, "start", 5) == 0)
ieee80211_wake_queues(ah->hw); ieee80211_wake_queues(ah->hw);
else if (strncmp(buf, "stop", 4) == 0) else if (strncmp(buf, "stop", 4) == 0)
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册