diff options
| author | Ursula Braun <ubraun@linux.vnet.ibm.com> | 2016-10-12 12:38:50 +0200 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2016-10-13 16:59:45 +0200 |
| commit | 9edebf11a4aa6349fecaedd673516fcf1999956a (patch) | |
| tree | 6fb4ecd3d0b26dd6702dcffe6370fb0d28a9b065 /drivers/s390/net | |
| parent | s390/netiucv: get rid of one memcpy in netiucv_printuser (diff) | |
| download | linux-9edebf11a4aa6349fecaedd673516fcf1999956a.tar.xz linux-9edebf11a4aa6349fecaedd673516fcf1999956a.zip | |
s390/netiucv: improve checking of sysfs attribute buffer
High values are always wrong for netiucv's sysfs attribute "buffer".
But the current code does not detect values between 2**31 and 2**32
as invalid. Choosing type "unsigned int" for variable "bs1" and making
use of "kstrtouint()" improves the syntax checking for "buffer".
Signed-off-by: Ursula Braun <ubraun@linux.vnet.ibm.com>
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'drivers/s390/net')
| -rw-r--r-- | drivers/s390/net/netiucv.c | 14 |
1 files changed, 7 insertions, 7 deletions
diff --git a/drivers/s390/net/netiucv.c b/drivers/s390/net/netiucv.c index 88b6e9c56b4c..2f0f3918172a 100644 --- a/drivers/s390/net/netiucv.c +++ b/drivers/s390/net/netiucv.c @@ -1563,21 +1563,21 @@ static ssize_t buffer_write (struct device *dev, struct device_attribute *attr, { struct netiucv_priv *priv = dev_get_drvdata(dev); struct net_device *ndev = priv->conn->netdev; - char *e; - int bs1; + unsigned int bs1; + int rc; IUCV_DBF_TEXT(trace, 3, __func__); if (count >= 39) return -EINVAL; - bs1 = simple_strtoul(buf, &e, 0); + rc = kstrtouint(buf, 0, &bs1); - if (e && (!isspace(*e))) { - IUCV_DBF_TEXT_(setup, 2, "buffer_write: invalid char %02x\n", - *e); + if (rc == -EINVAL) { + IUCV_DBF_TEXT_(setup, 2, "buffer_write: invalid char %s\n", + buf); return -EINVAL; } - if (bs1 > NETIUCV_BUFSIZE_MAX) { + if ((rc == -ERANGE) || (bs1 > NETIUCV_BUFSIZE_MAX)) { IUCV_DBF_TEXT_(setup, 2, "buffer_write: buffer size %d too large\n", bs1); |