Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 5c807005 authored by Wei Liu's avatar Wei Liu Committed by David S. Miller
Browse files

xen-netback: fix debugfs write length check 



Enlarge buffer size and check input length properly, so that we don't
misuse -ENOSPC.

Note that command like "kickXXXX" is still allowed, that's one patch for
another day if we really want to be very strict on this.

Reported-by: default avatarSeeChen Ng <seechen81@gmail.com>
Signed-off-by: default avatarWei Liu <wei.liu2@citrix.com>
Cc: Zoltan Kiss <zoltan.kiss@citrix.com>
Cc: Ian Campbell <ian.campbell@citrix.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 490cc7d0

drivers/net/xen-netback/xenbus.c

+6 −3
Original line number Diff line number Diff line
@@ -116,6 +116,7 @@ static int xenvif_read_io_ring(struct seq_file *m, void *v) 
}



#define XENVIF_KICK_STR "kick"

#define BUFFER_SIZE     32



static ssize_t

xenvif_write_io_ring(struct file *filp, const char __user *buf, size_t count,
@@ -124,22 +125,24 @@ xenvif_write_io_ring(struct file *filp, const char __user *buf, size_t count, 
	struct xenvif_queue *queue =

		((struct seq_file *)filp->private_data)->private;

	int len;

	char write[sizeof(XENVIF_KICK_STR)];

	char write[BUFFER_SIZE];



	/* don't allow partial writes and check the length */

	if (*ppos != 0)

		return 0;

	if (count < sizeof(XENVIF_KICK_STR) - 1)

	if (count >= sizeof(write))

		return -ENOSPC;



	len = simple_write_to_buffer(write,

				     sizeof(write),

				     sizeof(write) - 1,

				     ppos,

				     buf,

				     count);

	if (len < 0)

		return len;



	write[len] = '\0';



	if (!strncmp(write, XENVIF_KICK_STR, sizeof(XENVIF_KICK_STR) - 1))

		xenvif_interrupt(0, (void *)queue);

	else {