Implement ->proc_write_buf() for the files in /proc/viafb so procfs copies in what is written before it pins the entry, and parse what was written from that copy. Writes larger than PAGE_SIZE - 1 bytes fail with -EINVAL now, the output device files refused anything over 63 bytes already. kstrtou8_from_user() looked at the first 10 bytes of what was written to dfph and dfpl, now the whole write is parsed.
Signed-off-by: Christian Brauner (Amutable) <[email protected]> --- drivers/video/fbdev/via/viafbdev.c | 46 +++++++++++++++++--------------------- 1 file changed, 21 insertions(+), 25 deletions(-) diff --git a/drivers/video/fbdev/via/viafbdev.c b/drivers/video/fbdev/via/viafbdev.c index 4b617e80a77c..94b303006915 100644 --- a/drivers/video/fbdev/via/viafbdev.c +++ b/drivers/video/fbdev/via/viafbdev.c @@ -1121,7 +1121,7 @@ static int viafb_dvp0_proc_show(struct seq_file *m, void *v) } static ssize_t viafb_dvp0_proc_write(struct file *file, - const char __user *buffer, size_t count, loff_t *pos) + char *buffer, size_t count, loff_t *pos) { char buf[20], *value, *pbuf; u8 reg_val = 0; @@ -1129,8 +1129,7 @@ static ssize_t viafb_dvp0_proc_write(struct file *file, if (count < 1) return -EINVAL; length = count > 20 ? 20 : count; - if (copy_from_user(&buf[0], buffer, length)) - return -EFAULT; + memcpy(&buf[0], buffer, length); buf[length - 1] = '\0'; /*Ensure end string */ pbuf = &buf[0]; for (i = 0; i < 3; i++) { @@ -1169,7 +1168,7 @@ static ssize_t viafb_dvp0_proc_write(struct file *file, static const struct proc_ops viafb_dvp0_proc_ops = { .proc_show = viafb_dvp0_proc_show, - .proc_write = viafb_dvp0_proc_write, + .proc_write_buf = viafb_dvp0_proc_write, }; static int viafb_dvp1_proc_show(struct seq_file *m, void *v) @@ -1183,7 +1182,7 @@ static int viafb_dvp1_proc_show(struct seq_file *m, void *v) } static ssize_t viafb_dvp1_proc_write(struct file *file, - const char __user *buffer, size_t count, loff_t *pos) + char *buffer, size_t count, loff_t *pos) { char buf[20], *value, *pbuf; u8 reg_val = 0; @@ -1191,8 +1190,7 @@ static ssize_t viafb_dvp1_proc_write(struct file *file, if (count < 1) return -EINVAL; length = count > 20 ? 20 : count; - if (copy_from_user(&buf[0], buffer, length)) - return -EFAULT; + memcpy(&buf[0], buffer, length); buf[length - 1] = '\0'; /*Ensure end string */ pbuf = &buf[0]; for (i = 0; i < 3; i++) { @@ -1225,7 +1223,7 @@ static ssize_t viafb_dvp1_proc_write(struct file *file, static const struct proc_ops viafb_dvp1_proc_ops = { .proc_show = viafb_dvp1_proc_show, - .proc_write = viafb_dvp1_proc_write, + .proc_write_buf = viafb_dvp1_proc_write, }; static int viafb_dfph_proc_show(struct seq_file *m, void *v) @@ -1237,11 +1235,11 @@ static int viafb_dfph_proc_show(struct seq_file *m, void *v) } static ssize_t viafb_dfph_proc_write(struct file *file, - const char __user *buffer, size_t count, loff_t *pos) + char *buffer, size_t count, loff_t *pos) { int err; u8 reg_val; - err = kstrtou8_from_user(buffer, count, 0, ®_val); + err = kstrtou8(buffer, 0, ®_val); if (err) return err; @@ -1251,7 +1249,7 @@ static ssize_t viafb_dfph_proc_write(struct file *file, static const struct proc_ops viafb_dfph_proc_ops = { .proc_show = viafb_dfph_proc_show, - .proc_write = viafb_dfph_proc_write, + .proc_write_buf = viafb_dfph_proc_write, }; static int viafb_dfpl_proc_show(struct seq_file *m, void *v) @@ -1263,11 +1261,11 @@ static int viafb_dfpl_proc_show(struct seq_file *m, void *v) } static ssize_t viafb_dfpl_proc_write(struct file *file, - const char __user *buffer, size_t count, loff_t *pos) + char *buffer, size_t count, loff_t *pos) { int err; u8 reg_val; - err = kstrtou8_from_user(buffer, count, 0, ®_val); + err = kstrtou8(buffer, 0, ®_val); if (err) return err; @@ -1277,7 +1275,7 @@ static ssize_t viafb_dfpl_proc_write(struct file *file, static const struct proc_ops viafb_dfpl_proc_ops = { .proc_show = viafb_dfpl_proc_show, - .proc_write = viafb_dfpl_proc_write, + .proc_write_buf = viafb_dfpl_proc_write, }; static int viafb_vt1636_proc_show(struct seq_file *m, void *v) @@ -1313,7 +1311,7 @@ static int viafb_vt1636_proc_show(struct seq_file *m, void *v) } static ssize_t viafb_vt1636_proc_write(struct file *file, - const char __user *buffer, size_t count, loff_t *pos) + char *buffer, size_t count, loff_t *pos) { char buf[30], *value, *pbuf; struct IODATA reg_val; @@ -1321,8 +1319,7 @@ static ssize_t viafb_vt1636_proc_write(struct file *file, if (count < 1) return -EINVAL; length = count > 30 ? 30 : count; - if (copy_from_user(&buf[0], buffer, length)) - return -EFAULT; + memcpy(&buf[0], buffer, length); buf[length - 1] = '\0'; /*Ensure end string */ pbuf = &buf[0]; switch (viaparinfo->chip_info->lvds_chip_info.lvds_chip_name) { @@ -1404,7 +1401,7 @@ static ssize_t viafb_vt1636_proc_write(struct file *file, static const struct proc_ops viafb_vt1636_proc_ops = { .proc_show = viafb_vt1636_proc_show, - .proc_write = viafb_vt1636_proc_write, + .proc_write_buf = viafb_vt1636_proc_write, }; #endif /* CONFIG_FB_VIA_DIRECT_PROCFS */ @@ -1416,7 +1413,7 @@ static int __maybe_unused viafb_sup_odev_proc_show(struct seq_file *m, void *v) return 0; } -static ssize_t odev_update(const char __user *buffer, size_t count, u32 *odev) +static ssize_t odev_update(const char *buffer, size_t count, u32 *odev) { char buf[64], *ptr = buf; u32 devices; @@ -1424,8 +1421,7 @@ static ssize_t odev_update(const char __user *buffer, size_t count, u32 *odev) if (count < 1 || count > 63) return -EINVAL; - if (copy_from_user(&buf[0], buffer, count)) - return -EFAULT; + memcpy(&buf[0], buffer, count); buf[count] = '\0'; add = buf[0] == '+'; sub = buf[0] == '-'; @@ -1452,7 +1448,7 @@ static int viafb_iga1_odev_proc_show(struct seq_file *m, void *v) } static ssize_t viafb_iga1_odev_proc_write(struct file *file, - const char __user *buffer, size_t count, loff_t *pos) + char *buffer, size_t count, loff_t *pos) { u32 dev_on, dev_off, dev_old, dev_new; ssize_t res; @@ -1473,7 +1469,7 @@ static ssize_t viafb_iga1_odev_proc_write(struct file *file, static const struct proc_ops viafb_iga1_odev_proc_ops = { .proc_show = viafb_iga1_odev_proc_show, - .proc_write = viafb_iga1_odev_proc_write, + .proc_write_buf = viafb_iga1_odev_proc_write, }; static int viafb_iga2_odev_proc_show(struct seq_file *m, void *v) @@ -1483,7 +1479,7 @@ static int viafb_iga2_odev_proc_show(struct seq_file *m, void *v) } static ssize_t viafb_iga2_odev_proc_write(struct file *file, - const char __user *buffer, size_t count, loff_t *pos) + char *buffer, size_t count, loff_t *pos) { u32 dev_on, dev_off, dev_old, dev_new; ssize_t res; @@ -1504,7 +1500,7 @@ static ssize_t viafb_iga2_odev_proc_write(struct file *file, static const struct proc_ops viafb_iga2_odev_proc_ops = { .proc_show = viafb_iga2_odev_proc_show, - .proc_write = viafb_iga2_odev_proc_write, + .proc_write_buf = viafb_iga2_odev_proc_write, }; #define IS_VT1636(lvds_chip) ((lvds_chip).lvds_chip_name == VT1636_LVDS) -- 2.53.0
