[PATCH] RTAS syscall - review request

[Nathan Lynch]

Hi John-

> +/* RTAS Userspace access */
> +static ssize_t ppc_rtas_rmo_buf_read(struct file *file, char *buf,
> +				    size_t count, loff_t *ppos)
> +{
> +	int n;
> +
> +	n = sprintf(buf, "%p %x\n", rtas_rmo_buf, RTAS_SYSCALL_MAX);
>  	if (*ppos >= strlen(buf))
>  		return 0;
>  	if (n > strlen(buf) - *ppos)

I don't think you can directly write to buf here; you should be using
copy_to_user().  I believe it should look something like this (I've
omitted error and bounds checking):

static ssize_t ppc_rtas_rmo_buf_read(struct file *file, char __user
*buf, size_t count, loff_t *ppos)
{
	int n;
	char *kbuf = kmalloc(count, GFP_KERNEL);

	n = sprintf(buf, "%p %x\n", rtas_rmo_buf, RTAS_SYSCALL_MAX);
	...
	copy_to_user(buf, kbuf, count);
	kfree(kbuf);
}


Nathan


** Sent via the linuxppc64-dev mail list. See http://lists.linuxppc.org/