On Tue, May 06, 2025 at 02:38:09PM -0700, Zaid Alali wrote:
> -static int error_type_set(void *data, u64 val)
> +static ssize_t error_type_set(struct file *file, const char __user *buf,
> + size_t count, loff_t *ppos)
> {
> int rc;
> + u64 val;
> +
Add
if (count > sizeof(einj_buf) - 1)
return -EINVAL;
to make sure copy_from_user() can't corrupt memory after
the einj_buf[].
> + memset(einj_buf, 0, sizeof(einj_buf));
> + if (copy_from_user(einj_buf, buf, count))
> + return -EFAULT;
> +
> + if (strncmp(einj_buf, "V2_", 3) == 0) {
> + if (!sscanf(einj_buf, "V2_%llx", &val))
> + return -EINVAL;
> + } else {
> + if (!sscanf(einj_buf, "%llx", &val))
> + return -EINVAL;
> + }
-Tony
