Implement ->proc_write_buf() for cio_ignore and cio_settle so procfs
copies in what is written before it pins the entry. cio_ignore parses
the list from that copy, up to the first NUL like strncpy_from_user()
handed it to it before. Writes larger than 64k still come up short, now
through PROC_ENTRY_SHORT_WRITES. Writes to cio_settle larger than
PAGE_SIZE - 1 bytes fail with -EINVAL now, it never looked at what was
written.
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
---
drivers/s390/cio/blacklist.c | 33 ++++++++++-----------------------
drivers/s390/cio/css.c | 4 ++--
2 files changed, 12 insertions(+), 25 deletions(-)
diff --git a/drivers/s390/cio/blacklist.c b/drivers/s390/cio/blacklist.c
index 4e02f78f6102..1ec7915be6b3 100644
--- a/drivers/s390/cio/blacklist.c
+++ b/drivers/s390/cio/blacklist.c
@@ -12,7 +12,7 @@
#include <linux/hex.h>
#include <linux/init.h>
-#include <linux/vmalloc.h>
+#include <linux/sizes.h>
#include <linux/proc_fs.h>
#include <linux/seq_file.h>
#include <linux/ctype.h>
@@ -355,39 +355,24 @@ cio_ignore_proc_seq_show(struct seq_file *s, void *it)
}
static ssize_t
-cio_ignore_write(struct file *file, const char __user *user_buf,
+cio_ignore_write(struct file *file, char *buf,
size_t user_len, loff_t *offset)
{
- char *buf;
- ssize_t rc, ret, i;
+ ssize_t ret, i;
if (*offset)
return -EINVAL;
- if (user_len > 65536)
- user_len = 65536;
- buf = vzalloc(user_len + 1); /* maybe better use the stack? */
- if (buf == NULL)
- return -ENOMEM;
- if (strncpy_from_user (buf, user_buf, user_len) < 0) {
- rc = -EFAULT;
- goto out_free;
- }
-
- i = user_len - 1;
+ /* the parser never saw what follows a NUL */
+ i = strnlen(buf, user_len) - 1;
while ((i >= 0) && (isspace(buf[i]) || (buf[i] == 0))) {
buf[i] = '\0';
i--;
}
ret = blacklist_parse_proc_parameters(buf);
if (ret)
- rc = ret;
- else
- rc = user_len;
-
-out_free:
- vfree (buf);
- return rc;
+ return ret;
+ return user_len;
}
static const struct seq_operations cio_ignore_proc_seq_ops = {@@ -398,9 +383,11 @@ static const struct seq_operations cio_ignore_proc_seq_ops = {
};
static const struct proc_ops cio_ignore_proc_ops = {
+ .proc_flags = PROC_ENTRY_SHORT_WRITES,
.proc_seq_ops = &cio_ignore_proc_seq_ops,
.proc_state_size = sizeof(struct ccwdev_iter),
- .proc_write = cio_ignore_write,
+ .proc_write_buf = cio_ignore_write,
+ .proc_write_size = SZ_64K,
};
static intdiff --git a/drivers/s390/cio/css.c b/drivers/s390/cio/css.c
index 54b8b8639694..efd3df3e90ba 100644
--- a/drivers/s390/cio/css.c
+++ b/drivers/s390/cio/css.c
@@ -1278,7 +1278,7 @@ static int __init channel_subsystem_init_sync(void)
subsys_initcall_sync(channel_subsystem_init_sync);
#ifdef CONFIG_PROC_FS
-static ssize_t cio_settle_write(struct file *file, const char __user *buf,
+static ssize_t cio_settle_write(struct file *file, char *buf,
size_t count, loff_t *ppos)
{
int ret;@@ -1292,7 +1292,7 @@ static ssize_t cio_settle_write(struct file *file, const char __user *buf,
static const struct proc_ops cio_settle_proc_ops = {
.proc_open = nonseekable_open,
- .proc_write = cio_settle_write,
+ .proc_write_buf = cio_settle_write,
};
static int __init cio_settle_init(void)
--
2.53.0