Skip to content

Commit

Permalink
Staging: silicom: use kstrtoint_from_user()
Browse files Browse the repository at this point in the history
The main problem with the hand rolled code was that there weren't any
range checks so you could corrupt memory by writing too much data to
the proc file.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Daniel Cotey <puff65537@bansheeslibrary.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  • Loading branch information
Dan Carpenter authored and Greg Kroah-Hartman committed Sep 17, 2012
1 parent e4c536b commit 82e6bb0
Showing 1 changed file with 10 additions and 22 deletions.
32 changes: 10 additions & 22 deletions drivers/staging/silicom/bp_mod.c
Original file line number Diff line number Diff line change
Expand Up @@ -8071,20 +8071,13 @@ int
set_bypass_wd_pfs(struct file *file, const char *buffer,
unsigned long count, void *data)
{

char kbuf[256];
bpctl_dev_t *pbp_device_block = (bpctl_dev_t *) data;
int timeout;
int ret;

unsigned int timeout = 0;
char *timeout_ptr = kbuf;

if (copy_from_user(&kbuf, buffer, count)) {
return -1;
}

timeout_ptr = kbuf;
timeout = atoi(&timeout_ptr);

ret = kstrtoint_from_user(buffer, count, 10, &timeout);
if (ret)
return ret;
set_bypass_wd_fn(pbp_device_block, timeout);

return count;
Expand Down Expand Up @@ -8712,18 +8705,13 @@ int
set_wd_autoreset_pfs(struct file *file, const char *buffer,
unsigned long count, void *data)
{
char kbuf[256];
bpctl_dev_t *pbp_device_block = (bpctl_dev_t *) data;
u32 timeout = 0;
char *timeout_ptr = kbuf;

if (copy_from_user(&kbuf, buffer, count)) {
return -1;
}

timeout_ptr = kbuf;
timeout = atoi(&timeout_ptr);
int timeout;
int ret;

ret = kstrtoint_from_user(buffer, count, 10, &timeout);
if (ret)
return ret;
set_wd_autoreset_fn(pbp_device_block, timeout);

return count;
Expand Down

0 comments on commit 82e6bb0

Please sign in to comment.