Implement ->proc_write_buf() so procfs copies in what is written before it pins the entry, and handle the keys from that copy. Writes larger than PAGE_SIZE - 1 bytes fail with -EINVAL now. They used to trigger the first key, or all of them in bulk mode. procfs allocates the copy, which is as small as the write, opening the file allocated as much already.
Signed-off-by: Christian Brauner (Amutable) <[email protected]> --- drivers/tty/sysrq.c | 9 +++------ 1 file changed, 3 insertions(+), 6 deletions(-) diff --git a/drivers/tty/sysrq.c b/drivers/tty/sysrq.c index f4571d05b496..99363e1b59ed 100644 --- a/drivers/tty/sysrq.c +++ b/drivers/tty/sysrq.c @@ -1200,17 +1200,14 @@ EXPORT_SYMBOL(unregister_sysrq_key); * However, if the first character is an underscore, * all characters are processed. */ -static ssize_t write_sysrq_trigger(struct file *file, const char __user *buf, +static ssize_t write_sysrq_trigger(struct file *file, char *buf, size_t count, loff_t *ppos) { bool bulk = false; size_t i; for (i = 0; i < count; i++) { - char c; - - if (get_user(c, buf + i)) - return -EFAULT; + char c = buf[i]; if (c == '_') bulk = true; @@ -1225,7 +1222,7 @@ static ssize_t write_sysrq_trigger(struct file *file, const char __user *buf, } static const struct proc_ops sysrq_trigger_proc_ops = { - .proc_write = write_sysrq_trigger, + .proc_write_buf = write_sysrq_trigger, .proc_lseek = noop_llseek, }; -- 2.53.0
