Implement ->proc_write_buf() so procfs copies in what is written before it pins the entry, and parse the command from that copy. Writes larger than PAGE_SIZE - 1 bytes fail with -EINVAL now.
Signed-off-by: Christian Brauner (Amutable) <[email protected]> --- arch/x86/kernel/cpu/mtrr/if.c | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/arch/x86/kernel/cpu/mtrr/if.c b/arch/x86/kernel/cpu/mtrr/if.c index 9510e01d5103..038e2dc38797 100644 --- a/arch/x86/kernel/cpu/mtrr/if.c +++ b/arch/x86/kernel/cpu/mtrr/if.c @@ -91,7 +91,7 @@ mtrr_file_del(unsigned long base, unsigned long size, * "base=%Lx size=%Lx type=%s" or "disable=%d" */ static ssize_t -mtrr_write(struct file *file, const char __user *buf, size_t len, loff_t * ppos) +mtrr_write(struct file *file, char *buf, size_t len, loff_t * ppos) { int i, err; unsigned long reg; @@ -103,9 +103,8 @@ mtrr_write(struct file *file, const char __user *buf, size_t len, loff_t * ppos) memset(line, 0, LINE_SIZE); len = min_t(size_t, len, LINE_SIZE - 1); - length = strncpy_from_user(line, buf, len); - if (length < 0) - return length; + length = strnlen(buf, len); + memcpy(line, buf, length); ptr = line + length - 1; if (length && *ptr == '\n') @@ -397,7 +396,7 @@ static int mtrr_open(struct inode *inode, struct file *file) static const struct proc_ops mtrr_proc_ops = { .proc_show = mtrr_seq_show, .proc_open = mtrr_open, - .proc_write = mtrr_write, + .proc_write_buf = mtrr_write, .proc_ioctl = mtrr_ioctl, #ifdef CONFIG_COMPAT .proc_compat_ioctl = mtrr_ioctl, -- 2.53.0
