lkml.org 
[lkml]   [2016]   [Sep]   [15]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
SubjectRe: [PATCH v3] leds: Introduce userspace leds driver
From
Date
Hi Pavel,

On 09/15/2016 03:08 PM, Pavel Machek wrote:
> Hi!
>
>>> + if (copy_from_user(&udev->user_dev, buffer,
>>> + sizeof(struct uleds_user_dev))) {
>>> + ret = -EFAULT;
>>> + goto out;
>>> + }
>>> +
>>> + if (!udev->user_dev.name[0]) {
>>> + ret = -EINVAL;
>>> + goto out;
>>> + }
>>> +
>>> + ret = led_classdev_register(NULL, &udev->led_cdev);
>>> + if (ret < 0)
>>> + goto out;
>
> No sanity checking on the name -> probably a security hole. Do not
> push this upstream before this is fixed.

Thanks for catching this.

David, please check if the LED name sticks to the LED class
device naming convention.

And one thing that caught my eye only now - please use
devm_led_classdev_register().

For now I'm dropping the patch.

--
Best regards,
Jacek Anaszewski

\
 
 \ /
  Last update: 2016-09-17 09:59    [W:0.063 / U:0.248 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site