aboutsummaryrefslogtreecommitdiff
path: root/drivers/pcmcia/cistpl.c
diff options
context:
space:
mode:
authorDavid Fries <david@fries.net>2008-10-15 22:04:51 -0700
committerLinus Torvalds <torvalds@linux-foundation.org>2008-10-16 11:21:50 -0700
commit347ba8a588c3e49f357291e5a1ac38a11d7e052d (patch)
treee3f67be1903df707e60116f841b8082da7facc7b /drivers/pcmcia/cistpl.c
parent07e003417b88deac4b887c98f499fc3b01bc8df0 (diff)
W1: w1_therm fix user buffer overflow and cat
Fixed data reading bug by replacing binary attribute with device one. Switching the sysfs read from bin_attribute to device_attribute. The data is far under PAGE_SIZE so the binary interface isn't required. As the device_attribute interface will make one call to w1_therm_read per file open and buffer, the result is, the following problems go away. buffer overflow: Execute a short read on w1_slave and w1_therm_read_bin would still return the full string size worth of data clobbering the user space buffer when it returned. Switching to device_attribute avoids the buffer overflow problems. With the snprintf formatted output dealing with short reads without doing a conversion per read would have been difficult. bad behavior: `cat w1_slave` would cause two temperature conversions to take place. Previously the code assumed W1_SLAVE_DATA_SIZE would be returned with each read. It would not return 0 unless the offset was less than W1_SLAVE_DATA_SIZE. The result was the first read did a temperature conversion, filled the buffer and returned, the offset in the second read would be less than W1_SLAVE_DATA_SIZE and also fill the buffer and return, the third read would finnally have a big enough offset to return 0 and cause cat to stop. Now w1_therm_read will be called at most once per open. Signed-off-by: David Fries <david@fries.net> Signed-off-by: Evgeniy Polyakov <johnpol@2ka.mipt.ru> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Diffstat (limited to 'drivers/pcmcia/cistpl.c')
0 files changed, 0 insertions, 0 deletions