Drop the local 10-byte buffer. The old code copied at most 9 bytes from
the user buffer, but only the first byte was used to select the RTAS
operation.

Use get_user() to read the command byte instead and compare it directly
with '0' and '1'. Drop the explicit user buffer check, since get_user()
will fail on a NULL pointer and correctly return -EFAULT instead of
-EINVAL. Remove the now-obsolete string constants as well as any
strncmp() and strlen() calls.

Return the original count instead of a potentially capped value, since
the full user write has been consumed once the command is accepted.

Use unsigned int op to better match the manage_flash() interface.

Signed-off-by: Thorsten Blum <[email protected]>
---
 arch/powerpc/kernel/rtas_flash.c | 27 ++++++++++-----------------
 1 file changed, 10 insertions(+), 17 deletions(-)

diff --git a/arch/powerpc/kernel/rtas_flash.c b/arch/powerpc/kernel/rtas_flash.c
index 583dc16e9d3c..722dbfb6fbf8 100644
--- a/arch/powerpc/kernel/rtas_flash.c
+++ b/arch/powerpc/kernel/rtas_flash.c
@@ -394,30 +394,23 @@ static ssize_t manage_flash_write(struct file *file, 
const char __user *buf,
                                size_t count, loff_t *off)
 {
        struct rtas_manage_flash_t *const args_buf = &rtas_manage_flash_data;
-       static const char reject_str[] = "0";
-       static const char commit_str[] = "1";
-       char stkbuf[10];
-       int op;
+       unsigned int op;
+       char cmd;
 
        guard(mutex)(&rtas_manage_flash_mutex);
 
        if ((args_buf->status == MANAGE_AUTH) || (count == 0))
                return count;
                
-       op = -1;
-       if (buf) {
-               if (count > 9) count = 9;
-               if (copy_from_user (stkbuf, buf, count))
-                       return -EFAULT;
-               if (strncmp(stkbuf, reject_str, strlen(reject_str)) == 0) 
-                       op = RTAS_REJECT_TMP_IMG;
-               else if (strncmp(stkbuf, commit_str, strlen(commit_str)) == 0) 
-                       op = RTAS_COMMIT_TMP_IMG;
-       }
-       
-       if (op == -1) {   /* buf is empty, or contains invalid string */
+       if (get_user(cmd, buf))
+               return -EFAULT;
+
+       if (cmd == '0')
+               op = RTAS_REJECT_TMP_IMG;
+       else if (cmd == '1')
+               op = RTAS_COMMIT_TMP_IMG;
+       else
                return -EINVAL;
-       }
 
        manage_flash(args_buf, op);
        return count;

Reply via email to