Implement ->proc_write_buf() so procfs copies in what is written before it pins the entry, and parse the level from that copy. Writes larger than PAGE_SIZE - 1 bytes fail with -EINVAL now, and a buffer that can't be read fails with -EFAULT instead of looking like it was written. Signed-off-by: Christian Brauner (Amutable) --- drivers/net/wireless/intel/ipw2x00/libipw_module.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/drivers/net/wireless/intel/ipw2x00/libipw_module.c b/drivers/net/wireless/intel/ipw2x00/libipw_module.c index 15d9a5efb581..08cc0d7f57c1 100644 --- a/drivers/net/wireless/intel/ipw2x00/libipw_module.c +++ b/drivers/net/wireless/intel/ipw2x00/libipw_module.c @@ -216,14 +216,13 @@ static int debug_level_proc_show(struct seq_file *m, void *v) } static ssize_t debug_level_proc_write(struct file *file, - const char __user *buffer, size_t count, loff_t *pos) + char *buffer, size_t count, loff_t *pos) { char buf[] = "0x00000000\n"; size_t len = min(sizeof(buf) - 1, count); unsigned long val; - if (copy_from_user(buf, buffer, len)) - return count; + memcpy(buf, buffer, len); buf[len] = 0; if (sscanf(buf, "%li", &val) != 1) printk(KERN_INFO DRV_NAME @@ -236,7 +235,7 @@ static ssize_t debug_level_proc_write(struct file *file, static const struct proc_ops debug_level_proc_ops = { .proc_show = debug_level_proc_show, - .proc_write = debug_level_proc_write, + .proc_write_buf = debug_level_proc_write, }; #endif /* CONFIG_LIBIPW_DEBUG */ -- 2.53.0