Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 61a0bc0f authored by Ken Cox's avatar Ken Cox Committed by Greg Kroah-Hartman
Browse files

Staging: unisys: Fix multiple variable length array declarations 



There were multiple variable length arrays declared on the stack in proc
handlers:
	char buf[count];

I changed these to be fixed length arrays.

Signed-off-by: default avatarKen Cox <jkc@redhat.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 56df0122

drivers/staging/unisys/uislib/uislib.c

+31 −8
Original line number Diff line number Diff line
@@ -1509,9 +1509,12 @@ vnic_proc_write(struct file *file, const char __user *buffer, 
		size_t count, loff_t *ppos)

{

	int action = 0xffff, busNo = 0, i, result = 0;

	char buf[count];

	char buf[4];

	char direction;

/* GUID guid; */

	if (count >= ARRAY_SIZE(buf))

		return -EINVAL;



	if (copy_from_user(buf, buffer, count)) {

		LOGERR("echo > /proc/uislib/vnic copy_from_user ****FAILED.\n");

		return -EFAULT;
@@ -1566,9 +1569,12 @@ chipset_proc_write(struct file *file, const char __user *buffer, 
		   size_t count, loff_t *ppos)

{

	int i, action = 0xffff;

	char buf[count];

	char buf[4];

	CONTROLVM_MESSAGE msg;



	if (count >= ARRAY_SIZE(buf))

		return -EINVAL;



	memset(&msg, 0, sizeof(CONTROLVM_MESSAGE));



	if (copy_from_user(buf, buffer, count)) {
@@ -1811,10 +1817,13 @@ bus_proc_write(struct file *file, const char __user *buffer, 
{

	int server_flag = 0;

	int i, action = 0xffff, result;

	char buf[count];

	char buf[16];

	CONTROLVM_MESSAGE msg;

	U32 busNo, deviceCount;



	if (count >= ARRAY_SIZE(buf))

		return -EINVAL;



	memset(&msg, 0, sizeof(CONTROLVM_MESSAGE));



	if (copy_from_user(buf, buffer, count)) {
@@ -1892,10 +1901,13 @@ dev_proc_write(struct file *file, const char __user *buffer, 
	int server_flag = 0;

	CONTROLVM_MESSAGE msg;

	U32 busNo, devNo;

	char buf[count];

	char buf[32];

	unsigned int chanptr;

	int type, i, action = 0xffff, result;



	if (count >= ARRAY_SIZE(buf))

		return -EINVAL;



	if (copy_from_user(buf, buffer, count)) {

		LOGERR("echo > /proc/uislib/device: copy_from_user ****FAILED.");

		return -EFAULT;
@@ -1985,7 +1997,7 @@ static ssize_t 
cycles_before_wait_proc_write(struct file *file, const char __user *buffer,

			      size_t count, loff_t *ppos)

{

	char buf[count];

	char buf[16];



#define CYCLES_BEFORE_WAIT_USE_ERROR  { \

	LOGERR("Incorrect Call Home Input.\n"); \
@@ -1993,6 +2005,8 @@ cycles_before_wait_proc_write(struct file *file, const char __user *buffer, 
	pr_info("EventID Category Type[parameter1][parameter2][parameter3][parameter4][parameter5][parameter6]\n"); \

	return -EFAULT; \

}

	if (count >= ARRAY_SIZE(buf))

		return -EINVAL;



	if (count == 0)

		CYCLES_BEFORE_WAIT_USE_ERROR;
@@ -2014,7 +2028,7 @@ static ssize_t 
reset_counts_proc_write(struct file *file, const char __user *buffer,

			size_t count, loff_t *ppos)

{

	char buf[count];

	char buf[16];

	unsigned long long new_value;

	struct bus_info *bus;

	int i;
@@ -2026,6 +2040,9 @@ reset_counts_proc_write(struct file *file, const char __user *buffer, 
	return -EFAULT; \

	}



	if (count >= ARRAY_SIZE(buf))

		return -EINVAL;



	if (count == 0)

		RESET_COUNTS_USE_ERROR;
@@ -2061,7 +2078,7 @@ static ssize_t 
smart_wakeup_proc_write(struct file *file, const char __user *buffer,

			size_t count, loff_t *ppos)

{

	char buf[count];

	char buf[16];

	int new_value;



#define SMART_WAKEUP_USE_ERROR  { \
@@ -2071,6 +2088,9 @@ smart_wakeup_proc_write(struct file *file, const char __user *buffer, 
	return -EFAULT; \

	}



	if (count >= ARRAY_SIZE(buf))

		return -EINVAL;



	if (count == 0)

		SMART_WAKEUP_USE_ERROR;
@@ -2092,10 +2112,13 @@ test_proc_write(struct file *file, const char __user *buffer, 
		size_t count, loff_t *ppos)

{

	int i, action = 0xffff;

	char buf[count];

	char buf[16];

	CONTROLVM_MESSAGE msg;

	S64 vrtc_offset;



	if (count >= ARRAY_SIZE(buf))

		return -EINVAL;



	memset(&msg, 0, sizeof(CONTROLVM_MESSAGE));



	if (copy_from_user(buf, buffer, count)) {

drivers/staging/unisys/virthba/virthba.c

+4 −1
Original line number Diff line number Diff line
@@ -1493,9 +1493,12 @@ static ssize_t 
rqwu_proc_write(struct file *file, const char __user *buffer,

		size_t count, loff_t *ppos)

{

	char buf[count];

	char buf[16];

	int i, usecs;



	if (count >= ARRAY_SIZE(buf))

		return -EINVAL;



	if (copy_from_user(buf, buffer, count)) {

		LOGERR("copy_from_user failed. buf<<%.*s>> count<<%lu>>\n",

		       (int) count, buf, count);

drivers/staging/unisys/virtpci/virtpci.c

+4 −1
Original line number Diff line number Diff line
@@ -1488,7 +1488,7 @@ static ssize_t info_proc_read(struct file *file, char __user *buf, 
static ssize_t virt_proc_write(struct file *file, const char __user *buffer,

			       size_t count, loff_t *ppos)

{

	char buf[count];

	char buf[16];

	int type, i, action = 0xffff;

	unsigned int busno, deviceno;

	void *chanptr;
@@ -1518,6 +1518,9 @@ static ssize_t virt_proc_write(struct file *file, const char __user *buffer, 
	return -EINVAL; \

}



	if (count >= ARRAY_SIZE(buf))

		return -EINVAL;



	if (copy_from_user(buf, buffer, count)) {

		LOGERR("copy_from_user failed.\n");

		return -EFAULT;