Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 6f9b3e77 authored by Bartosz Golaszewski's avatar Bartosz Golaszewski Committed by Linus Walleij
Browse files

gpio: mockup: improve the debugfs input sanitization 



We're currently only checking the first character of the input to the
debugfs event files, so a string like '0sdfdsf' is valid and indicates
a falling edge event.

Be more strict and only allow '0', '1', '0\n' & '1\n'.

While we're at it: move the sanitization code before the irq_enabled
check so that we indicate an error on invalid input even if nobody is
waiting for events.

Signed-off-by: default avatarBartosz Golaszewski <brgl@bgdev.pl>
Reviewed-by: default avatarAndy Shevchenko <andy.shevchenko@gmail.com>
Signed-off-by: default avatarLinus Walleij <linus.walleij@linaro.org>
parent b6730b20

drivers/gpio/gpio-mockup.c

+7 −12
Original line number Diff line number Diff line
@@ -208,8 +208,7 @@ static ssize_t gpio_mockup_event_write(struct file *file, 
	struct seq_file *sfile;

	struct gpio_desc *desc;

	struct gpio_chip *gc;

	int val;

	char buf;

	int rv, val;



	sfile = file->private_data;

	priv = sfile->private;
@@ -217,19 +216,15 @@ static ssize_t gpio_mockup_event_write(struct file *file, 
	chip = priv->chip;

	gc = &chip->gc;



	rv = kstrtoint_from_user(usr_buf, size, 0, &val);

	if (rv)

		return rv;

	if (val != 0 && val != 1)

		return -EINVAL;



	if (!chip->lines[priv->offset].irq_enabled)

		return size;



	if (copy_from_user(&buf, usr_buf, 1))

		return -EFAULT;



	if (buf == '0')

		val = 0;

	else if (buf == '1')

		val = 1;

	else

		return -EINVAL;



	gpiod_set_value_cansleep(desc, val);

	priv->chip->irq_ctx.irq = gc->irq_base + priv->offset;

	irq_work_queue(&priv->chip->irq_ctx.work);