From b1e9e20952796a79636e441d5c92e9722ea5cb39 Mon Sep 17 00:00:00 2001
From: Jim Cromie <jim.cromie@gmail.com>
Date: Mon, 19 Dec 2011 17:13:07 -0500
Subject: [PATCH] --- yaml --- r: 288834 b: refs/heads/master c:
 7281491c594e7b8501eb5dfcf6cd3724f8a1b5b0 h: refs/heads/master v: v3

---
 [refs]                    |  2 +-
 trunk/lib/dynamic_debug.c | 16 ++++++++++++----
 2 files changed, 13 insertions(+), 5 deletions(-)

diff --git a/[refs] b/[refs]
index ea32040f0ed9..398818ba8906 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: 8bd6026e88cb2eb1e60ee40c7a1a0786b2db6623
+refs/heads/master: 7281491c594e7b8501eb5dfcf6cd3724f8a1b5b0
diff --git a/trunk/lib/dynamic_debug.c b/trunk/lib/dynamic_debug.c
index 86a9abb9a1ce..d8773dcd83c5 100644
--- a/trunk/lib/dynamic_debug.c
+++ b/trunk/lib/dynamic_debug.c
@@ -570,24 +570,32 @@ __setup("ddebug_query=", ddebug_setup_query);
  * File_ops->write method for <debugfs>/dynamic_debug/conrol.  Gathers the
  * command text from userspace, parses and executes it.
  */
+#define USER_BUF_PAGE 4096
 static ssize_t ddebug_proc_write(struct file *file, const char __user *ubuf,
 				  size_t len, loff_t *offp)
 {
-	char tmpbuf[256];
+	char *tmpbuf;
 	int ret;
 
 	if (len == 0)
 		return 0;
-	/* we don't check *offp -- multiple writes() are allowed */
-	if (len > sizeof(tmpbuf)-1)
+	if (len > USER_BUF_PAGE - 1) {
+		pr_warn("expected <%d bytes into control\n", USER_BUF_PAGE);
 		return -E2BIG;
-	if (copy_from_user(tmpbuf, ubuf, len))
+	}
+	tmpbuf = kmalloc(len + 1, GFP_KERNEL);
+	if (!tmpbuf)
+		return -ENOMEM;
+	if (copy_from_user(tmpbuf, ubuf, len)) {
+		kfree(tmpbuf);
 		return -EFAULT;
+	}
 	tmpbuf[len] = '\0';
 	if (verbose)
 		pr_info("read %d bytes from userspace\n", (int)len);
 
 	ret = ddebug_exec_query(tmpbuf);
+	kfree(tmpbuf);
 	if (ret)
 		return ret;