Skip to content
  • David Fries's avatar
    W1: w1_therm fix user buffer overflow and cat · 347ba8a5
    David Fries authored
    
    
    Fixed data reading bug by replacing binary attribute with device one.
    
    Switching the sysfs read from bin_attribute to device_attribute.  The data
    is far under PAGE_SIZE so the binary interface isn't required.  As the
    device_attribute interface will make one call to w1_therm_read per file
    open and buffer, the result is, the following problems go away.
    
    buffer overflow:
    	Execute a short read on w1_slave and w1_therm_read_bin would still
    	return the full string size worth of data clobbering the user space
    	buffer when it returned.  Switching to device_attribute avoids the
    	buffer overflow problems.  With the snprintf formatted output dealing
    	with short reads without doing a conversion per read would have
    	been difficult.
    bad behavior:
    	`cat w1_slave` would cause two temperature conversions to take place.
    	Previously the code assumed W1_SLAVE_DATA_SIZE would be returned with
    	each read.  It would not return 0 unless the offset was less
    	than W1_SLAVE_DATA_SIZE.  The result was the first read did a
    	temperature conversion, filled the buffer and returned, the
    	offset in the second read would be less than
    	W1_SLAVE_DATA_SIZE and also fill the buffer and return, the
    	third read would finnally have a big enough offset to return 0
    	and cause cat to stop.  Now w1_therm_read will be called at
    	most once per open.
    
    Signed-off-by: default avatarDavid Fries <david@fries.net>
    Signed-off-by: default avatarEvgeniy Polyakov <johnpol@2ka.mipt.ru>
    Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
    Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
    347ba8a5