Implement ->proc_write_buf() so procfs copies in what is written to /proc/driver/rndis-<n> before it pins the entry, and handle the commands from that copy. Writes larger than PAGE_SIZE - 1 bytes fail with -EINVAL now.
Signed-off-by: Christian Brauner (Amutable) <[email protected]> --- drivers/usb/gadget/function/rndis.c | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/drivers/usb/gadget/function/rndis.c b/drivers/usb/gadget/function/rndis.c index 3c7bd30b8a3a..e05e0c6ae8fb 100644 --- a/drivers/usb/gadget/function/rndis.c +++ b/drivers/usb/gadget/function/rndis.c @@ -1138,7 +1138,7 @@ static int rndis_proc_show(struct seq_file *m, void *v) return 0; } -static ssize_t rndis_proc_write(struct file *file, const char __user *buffer, +static ssize_t rndis_proc_write(struct file *file, char *buffer, size_t count, loff_t *ppos) { rndis_params *p = pde_data(file_inode(file)); @@ -1146,9 +1146,8 @@ static ssize_t rndis_proc_write(struct file *file, const char __user *buffer, int i, fl_speed = 0; for (i = 0; i < count; i++) { - char c; - if (get_user(c, buffer)) - return -EFAULT; + char c = *buffer; + switch (c) { case '0': case '1': @@ -1185,7 +1184,7 @@ static ssize_t rndis_proc_write(struct file *file, const char __user *buffer, static const struct proc_ops rndis_proc_ops = { .proc_show = rndis_proc_show, - .proc_write = rndis_proc_write, + .proc_write_buf = rndis_proc_write, }; #define NAME_TEMPLATE "driver/rndis-%03d" -- 2.53.0
