From: Al Viro <viro@www.linux.org.uk>
Date: Sun, 3 Apr 2005 08:15:52 +0000 (+0100)
Subject: [PATCH] ieee80211_module.c::store_debug_level() cleanup
X-Git-Tag: v2.6.14-rc1~1017^2~46^2~5
X-Git-Url: http://pilppa.org/gitweb/?a=commitdiff_plain;h=695b5bc3ecfc7da0a29360a6c2ee0849ffdb300a;p=linux-2.6-omap-h63xx.git

[PATCH] ieee80211_module.c::store_debug_level() cleanup

	* trivial __user annotations
	* store_debug_level() sanitized a bit
Signed-off-by: Al Viro <viro@parcelfarce.linux.theplanet.co.uk>
---

diff --git a/net/ieee80211/ieee80211_module.c b/net/ieee80211/ieee80211_module.c
index e4ca0daaaee..90bc50b97ea 100644
--- a/net/ieee80211/ieee80211_module.c
+++ b/net/ieee80211/ieee80211_module.c
@@ -194,17 +194,23 @@ static int show_debug_level(char *page, char **start, off_t offset,
 	return snprintf(page, count, "0x%08X\n", ieee80211_debug_level);
 }
 
-static int store_debug_level(struct file *file, const char *buffer,
+static int store_debug_level(struct file *file, const char __user *buffer,
 			     unsigned long count, void *data)
 {
 	char buf[] = "0x00000000";
-	unsigned long len = min(sizeof(buf) - 1, (u32)count);
 	char *p = (char *)buf;
 	unsigned long val;
 
-	if (copy_from_user(buf, buffer, len))
+	if (count > sizeof(buf) - 1)
+		count = sizeof(buf) - 1;
+
+	if (copy_from_user(buf, buffer, count))
 		return count;
-	buf[len] = 0;
+	buf[count] = 0;
+	/*
+	 * what a FPOS...  What, sscanf(buf, "%i", &val) would be too
+	 * scary?
+	 */
 	if (p[1] == 'x' || p[1] == 'X' || p[0] == 'x' || p[0] == 'X') {
 		p++;
 		if (p[0] == 'x' || p[0] == 'X')
@@ -218,7 +224,7 @@ static int store_debug_level(struct file *file, const char *buffer,
 	else
 		ieee80211_debug_level = val;
 
-	return strnlen(buf, count);
+	return strlen(buf);
 }
 
 static int __init ieee80211_init(void)