Implement ->proc_write_buf() for cio_ignore and cio_settle so procfs copies in what is written before it pins the entry. cio_ignore parses the list from that copy, up to the first NUL like strncpy_from_user() handed it to it before. Writes larger than 64k still come up short, now through PROC_ENTRY_SHORT_WRITES. Writes to cio_settle larger than PAGE_SIZE - 1 bytes fail with -EINVAL now, it never looked at what was written.
Signed-off-by: Christian Brauner (Amutable) <[email protected]> --- drivers/s390/cio/blacklist.c | 33 ++++++++++----------------------- drivers/s390/cio/css.c | 4 ++-- 2 files changed, 12 insertions(+), 25 deletions(-) diff --git a/drivers/s390/cio/blacklist.c b/drivers/s390/cio/blacklist.c index 4e02f78f6102..1ec7915be6b3 100644 --- a/drivers/s390/cio/blacklist.c +++ b/drivers/s390/cio/blacklist.c @@ -12,7 +12,7 @@ #include <linux/hex.h> #include <linux/init.h> -#include <linux/vmalloc.h> +#include <linux/sizes.h> #include <linux/proc_fs.h> #include <linux/seq_file.h> #include <linux/ctype.h> @@ -355,39 +355,24 @@ cio_ignore_proc_seq_show(struct seq_file *s, void *it) } static ssize_t -cio_ignore_write(struct file *file, const char __user *user_buf, +cio_ignore_write(struct file *file, char *buf, size_t user_len, loff_t *offset) { - char *buf; - ssize_t rc, ret, i; + ssize_t ret, i; if (*offset) return -EINVAL; - if (user_len > 65536) - user_len = 65536; - buf = vzalloc(user_len + 1); /* maybe better use the stack? */ - if (buf == NULL) - return -ENOMEM; - if (strncpy_from_user (buf, user_buf, user_len) < 0) { - rc = -EFAULT; - goto out_free; - } - - i = user_len - 1; + /* the parser never saw what follows a NUL */ + i = strnlen(buf, user_len) - 1; while ((i >= 0) && (isspace(buf[i]) || (buf[i] == 0))) { buf[i] = '\0'; i--; } ret = blacklist_parse_proc_parameters(buf); if (ret) - rc = ret; - else - rc = user_len; - -out_free: - vfree (buf); - return rc; + return ret; + return user_len; } static const struct seq_operations cio_ignore_proc_seq_ops = { @@ -398,9 +383,11 @@ static const struct seq_operations cio_ignore_proc_seq_ops = { }; static const struct proc_ops cio_ignore_proc_ops = { + .proc_flags = PROC_ENTRY_SHORT_WRITES, .proc_seq_ops = &cio_ignore_proc_seq_ops, .proc_state_size = sizeof(struct ccwdev_iter), - .proc_write = cio_ignore_write, + .proc_write_buf = cio_ignore_write, + .proc_write_size = SZ_64K, }; static int diff --git a/drivers/s390/cio/css.c b/drivers/s390/cio/css.c index 54b8b8639694..efd3df3e90ba 100644 --- a/drivers/s390/cio/css.c +++ b/drivers/s390/cio/css.c @@ -1278,7 +1278,7 @@ static int __init channel_subsystem_init_sync(void) subsys_initcall_sync(channel_subsystem_init_sync); #ifdef CONFIG_PROC_FS -static ssize_t cio_settle_write(struct file *file, const char __user *buf, +static ssize_t cio_settle_write(struct file *file, char *buf, size_t count, loff_t *ppos) { int ret; @@ -1292,7 +1292,7 @@ static ssize_t cio_settle_write(struct file *file, const char __user *buf, static const struct proc_ops cio_settle_proc_ops = { .proc_open = nonseekable_open, - .proc_write = cio_settle_write, + .proc_write_buf = cio_settle_write, }; static int __init cio_settle_init(void) -- 2.53.0
