summaryrefslogtreecommitdiff
path: root/drivers/platform
diff options
context:
space:
mode:
authorHans de Goede <hdegoede@redhat.com>2021-06-21 21:36:48 +0200
committerHans de Goede <hdegoede@redhat.com>2021-06-22 11:42:31 +0200
commit71d69e82f4168713afd89804d6e5f52d0e3848a2 (patch)
tree41038ae86a4d0edecd47be0dc19ad2efd82ec90b /drivers/platform
parent72fbcac2f40e690e1a5584358750e546a2678c2c (diff)
platform/x86: think-lmi: Return EINVAL when kbdlang gets set to a 0 length string
Commit 0ddcf3a6b442 ("platform/x86: think-lmi: Avoid potential read before start of the buffer") moved the length == 0 up to before stripping the '\n' which typically gets added when users echo a value to a sysfs-attribute from the shell. This avoids a potential buffer-underrun, but it also causes a behavioral change, prior to this change "echo > kbdlang", iow writing just a single '\n' would result in an EINVAL error, but after the change this gets accepted setting kbdlang to an empty string. Fix this by replacing the manual '\n' check with using strchrnul() to get the length till '\n' or terminating 0 in one go; and then do the length != 0 check after this. Fixes: 0ddcf3a6b442 ("platform/x86: think-lmi: Avoid potential read before start of the buffer") Reported-by: Juha Leppänen <juha_efku@dnainternet.net> Suggested-by: Andy Shevchenko <andy.shevchenko@gmail.com> Signed-off-by: Hans de Goede <hdegoede@redhat.com> Link: https://lore.kernel.org/r/20210621193648.44138-1-hdegoede@redhat.com
Diffstat (limited to 'drivers/platform')
-rw-r--r--drivers/platform/x86/think-lmi.c11
1 files changed, 3 insertions, 8 deletions
diff --git a/drivers/platform/x86/think-lmi.c b/drivers/platform/x86/think-lmi.c
index c6c9fbb8a53e..b57061079288 100644
--- a/drivers/platform/x86/think-lmi.c
+++ b/drivers/platform/x86/think-lmi.c
@@ -442,14 +442,9 @@ static ssize_t kbdlang_store(struct kobject *kobj,
struct tlmi_pwd_setting *setting = to_tlmi_pwd_setting(kobj);
int length;
- length = strlen(buf);
- if (!length)
- return -EINVAL;
-
- if (buf[length-1] == '\n')
- length--;
-
- if (length >= TLMI_LANG_MAXLEN)
+ /* Calculate length till '\n' or terminating 0 */
+ length = strchrnul(buf, '\n') - buf;
+ if (!length || length >= TLMI_LANG_MAXLEN)
return -EINVAL;
memcpy(setting->kbdlang, buf, length);