diff options
| author | Dan Carpenter <dan.carpenter@oracle.com> | 2014-10-31 13:40:39 +0300 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2014-11-03 16:22:50 -0800 |
| commit | d0915b2255bfbdd537fd6a52f9a0a7037ecbe2d5 (patch) | |
| tree | a4e727a9f138f72a94f18d3a513cf9e5c824a183 /drivers/staging/rtl8188eu | |
| parent | f8e4df53c785a3c19650e57b5c514a4b50d82078 (diff) | |
staging: r8188eu: get a string from the user correctly
The original code had two bugs:
1) It didn't check if the string was zero length so it could oops when
it tried to dereference the ZERO_SIZE_PTR.
2) It didn't enforce that the string was NUL terminated.
It was also messy as pants.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers/staging/rtl8188eu')
| -rw-r--r-- | drivers/staging/rtl8188eu/os_dep/rtw_android.c | 22 |
1 files changed, 6 insertions, 16 deletions
diff --git a/drivers/staging/rtl8188eu/os_dep/rtw_android.c b/drivers/staging/rtl8188eu/os_dep/rtw_android.c index d9d55d12fd5f..b40317822aed 100644 --- a/drivers/staging/rtl8188eu/os_dep/rtw_android.c +++ b/drivers/staging/rtl8188eu/os_dep/rtw_android.c @@ -162,22 +162,12 @@ int rtw_android_priv_cmd(struct net_device *net, struct ifreq *ifr, int cmd) ret = -EFAULT; goto exit; } - command = kmalloc(priv_cmd.total_len, GFP_KERNEL); - if (!command) { - DBG_88E("%s: failed to allocate memory\n", __func__); - ret = -ENOMEM; - goto exit; - } - if (!access_ok(VERIFY_READ, priv_cmd.buf, priv_cmd.total_len)) { - DBG_88E("%s: failed to access memory\n", __func__); - ret = -EFAULT; - goto exit; - } - if (copy_from_user(command, (char __user *)priv_cmd.buf, - priv_cmd.total_len)) { - ret = -EFAULT; - goto exit; - } + if (priv_cmd.total_len < 1) + return -EINVAL; + command = memdup_user(priv_cmd.buf, priv_cmd.total_len); + if (IS_ERR(command)) + return PTR_ERR(command); + command[priv_cmd.total_len - 1] = 0; DBG_88E("%s: Android private cmd \"%s\" on %s\n", __func__, command, ifr->ifr_name); cmd_num = rtw_android_cmdstr_to_num(command); |