@@ -1180,9 +1180,16 @@ static ssize_t cyapa_update_fw_store(struct device *dev,
const char *buf, size_t count)
{
struct cyapa *cyapa = dev_get_drvdata(dev);
- const char *fw_name = CYAPA_FW_NAME;
+ const char *fw_name;
int ret;
+ /* Do not allow paths that step out of /lib/firmware */
+ if (strstr(buf, "../") != NULL)
+ return -EINVAL;
+
+ fw_name = !strncmp(buf, "1", count) ||
+ !strncmp(buf, "1\n", count) ? CYAPA_FW_NAME : buf;
+
ret = cyapa_firmware(cyapa, fw_name);
if (ret)
dev_err(dev, "firmware update failed, %d\n", ret);
Allow the name of the designated firmware to be passed as the argument to update_fw from user space. This will allow user space to specify which firmware to load. Signed-off-by: Benson Leung <bleung@chromium.org> --- drivers/input/mouse/cyapa.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-)