From nobody Mon Jun 8 14:35:07 2026 Received: from out-177.mta0.migadu.com (out-177.mta0.migadu.com [91.218.175.177]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 211F23F870F for ; Thu, 28 May 2026 20:13:03 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=91.218.175.177 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779999186; cv=none; b=DeojeMMeyWqUcXxGr5xkt79fhB4B3wh4vCMkiKZe6J5Jbkes2jqwbjAuNdITiEV9oi3ONZYsWim17sVcuao4BaW9CqxoHSfZ4HmbIpmvqfIMoN1EdryhMew9qr4jr0hdOggtfab34It4irjq0ydfb8azVKQIoaZNXXAkxdx3rPM= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779999186; c=relaxed/simple; bh=8O9URT5B5VeVobAXWIkIqYJmai22F4B/MFQ7ldsFD+k=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=dQgLAfYvBWKuv3GN773I+2JZ4DdGIhSRQWmgKxu9YK7pi19CKKZC+Cnvh/21Q9tr8oFkerbgUrMS2J/WLPjPjfpdyLjrutDzqE9K4xv1hWi16Ggwq0zLpLGbsudEEnhCcDmBQ1vnnpX05LiektWK5HrDBwXU9Wos1W5eyLh6BzM= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev; spf=pass smtp.mailfrom=linux.dev; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b=H0SYJgJ8; arc=none smtp.client-ip=91.218.175.177 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.dev Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b="H0SYJgJ8" X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1779999182; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding; bh=+6daMKvHNSz59JQjO/O9wJOU1wC6Fg64/a4W67M4u5w=; b=H0SYJgJ80WeMgeiLvSEnrDJBVKXYEmvimQDGfdr1u7NDg3iJKwdDAAmbDizbKm+bAHAdH2 pjnj1Vqz21cfPCRi7p5q361ox98x1vAr0ZaCDlkKuM0+kip1WY9p935wJyARlmPzHw2Lff Gg0ChWuAgrVcaawycTvKbDEjMaqigcM= From: Thorsten Blum To: Madhavan Srinivasan , Michael Ellerman , Nicholas Piggin , "Christophe Leroy (CS GROUP)" , Srikar Dronamraju , Shrikanth Hegde Cc: Thorsten Blum , linuxppc-dev@lists.ozlabs.org, linux-kernel@vger.kernel.org Subject: [PATCH] powerpc: rtas: use get_user to simplify manage_flash_write Date: Thu, 28 May 2026 22:12:27 +0200 Message-ID: <20260528201226.1599977-3-thorsten.blum@linux.dev> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=2184; i=thorsten.blum@linux.dev; h=from:subject; bh=8O9URT5B5VeVobAXWIkIqYJmai22F4B/MFQ7ldsFD+k=; b=owGbwMvMwCUWt7pQ4caZUj3G02pJDFkSC1eV3Uyd7Huj+H3uypjeSM7EnW3XEi+uc9Lo0BD5+ n2ftVhIRykLgxgXg6yYIsuDWT9m+JbWVG4yidgJM4eVCWQIAxenAEzEnZ+R4cr+zPiPCV1/Hm4U Fo9ftfUx/6Xjm74WXZRed//NesWH2gcZ/tcePH6M/UW71t7ohTxTrlnuPcDafyPy9EV+pZc1ioo a7xgA X-Developer-Key: i=thorsten.blum@linux.dev; a=openpgp; fpr=1D60735E8AEF3BE473B69D84733678FD8DFEEAD4 Content-Transfer-Encoding: quoted-printable X-Migadu-Flow: FLOW_OUT Content-Type: text/plain; charset="utf-8" Drop the local 10-byte buffer. The old code copied at most 9 bytes from the user buffer, but only the first byte was used to select the RTAS operation. Use get_user() to read the command byte instead and compare it directly with '0' and '1'. Drop the explicit user buffer check, since get_user() will fail on a NULL pointer and correctly return -EFAULT instead of -EINVAL. Remove the now-obsolete string constants as well as any strncmp() and strlen() calls. Return the original count instead of a potentially capped value, since the full user write has been consumed once the command is accepted. Use unsigned int op to better match the manage_flash() interface. Signed-off-by: Thorsten Blum --- arch/powerpc/kernel/rtas_flash.c | 27 ++++++++++----------------- 1 file changed, 10 insertions(+), 17 deletions(-) diff --git a/arch/powerpc/kernel/rtas_flash.c b/arch/powerpc/kernel/rtas_fl= ash.c index 583dc16e9d3c..722dbfb6fbf8 100644 --- a/arch/powerpc/kernel/rtas_flash.c +++ b/arch/powerpc/kernel/rtas_flash.c @@ -394,30 +394,23 @@ static ssize_t manage_flash_write(struct file *file, = const char __user *buf, size_t count, loff_t *off) { struct rtas_manage_flash_t *const args_buf =3D &rtas_manage_flash_data; - static const char reject_str[] =3D "0"; - static const char commit_str[] =3D "1"; - char stkbuf[10]; - int op; + unsigned int op; + char cmd; =20 guard(mutex)(&rtas_manage_flash_mutex); =20 if ((args_buf->status =3D=3D MANAGE_AUTH) || (count =3D=3D 0)) return count; =09 - op =3D -1; - if (buf) { - if (count > 9) count =3D 9; - if (copy_from_user (stkbuf, buf, count)) - return -EFAULT; - if (strncmp(stkbuf, reject_str, strlen(reject_str)) =3D=3D 0)=20 - op =3D RTAS_REJECT_TMP_IMG; - else if (strncmp(stkbuf, commit_str, strlen(commit_str)) =3D=3D 0)=20 - op =3D RTAS_COMMIT_TMP_IMG; - } -=09 - if (op =3D=3D -1) { /* buf is empty, or contains invalid string */ + if (get_user(cmd, buf)) + return -EFAULT; + + if (cmd =3D=3D '0') + op =3D RTAS_REJECT_TMP_IMG; + else if (cmd =3D=3D '1') + op =3D RTAS_COMMIT_TMP_IMG; + else return -EINVAL; - } =20 manage_flash(args_buf, op); return count;