package/kernel/mac80211/patches/rt2x00/001-rt2x00-use-simple_read_from_buffer.patch

   1 From f483039cf51acf30494cd754194562c22cf98764 Mon Sep 17 00:00:00 2001
   2 From: Dan Carpenter <dan.carpenter@oracle.com>
   3 Date: Wed, 22 Aug 2018 13:41:26 +0300
   4 Subject: [PATCH 01/28] rt2x00: use simple_read_from_buffer()
   5
   6 The problem with this copy_to_user() calls is that they don't ensure
   7 that "size" is less than the "length" which the user provided.
   8
   9 Obviously, this is debugfs and "size" is normally going to be very small
  10 so it probably doesn't matter, but this is the correct thing to do.
  11
  12 Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
  13 Acked-by: Stanislaw Gruszka <sgruszka@redhat.com>
  14 Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
  15 ---
  16  .../net/wireless/ralink/rt2x00/rt2x00debug.c   | 18 +++---------------
  17  1 file changed, 3 insertions(+), 15 deletions(-)
  18
  19 --- a/drivers/net/wireless/ralink/rt2x00/rt2x00debug.c
  20 +++ b/drivers/net/wireless/ralink/rt2x00/rt2x00debug.c
  21 @@ -464,11 +464,7 @@ static ssize_t rt2x00debug_read_##__name
  22                                                                 \
  23         size = sprintf(line, __format, value);                  \
  24                                                                 \
  25 -       if (copy_to_user(buf, line, size))                      \
  26 -               return -EFAULT;                                 \
  27 -                                                               \
  28 -       *offset += size;                                        \
  29 -       return size;                                            \
  30 +       return simple_read_from_buffer(buf, length, offset, line, size); \
  31  }
  32
  33  #define RT2X00DEBUGFS_OPS_WRITE(__name, __type)                        \
  34 @@ -545,11 +541,7 @@ static ssize_t rt2x00debug_read_dev_flag
  35
  36         size = sprintf(line, "0x%.8x\n", (unsigned int)intf->rt2x00dev->flags);
  37
  38 -       if (copy_to_user(buf, line, size))
  39 -               return -EFAULT;
  40 -
  41 -       *offset += size;
  42 -       return size;
  43 +       return simple_read_from_buffer(buf, length, offset, line, size);
  44  }
  45
  46  static const struct file_operations rt2x00debug_fop_dev_flags = {
  47 @@ -574,11 +566,7 @@ static ssize_t rt2x00debug_read_cap_flag
  48
  49         size = sprintf(line, "0x%.8x\n", (unsigned int)intf->rt2x00dev->cap_flags);
  50
  51 -       if (copy_to_user(buf, line, size))
  52 -               return -EFAULT;
  53 -
  54 -       *offset += size;
  55 -       return size;
  56 +       return simple_read_from_buffer(buf, length, offset, line, size);
  57  }
  58
  59  static const struct file_operations rt2x00debug_fop_cap_flags = {