Skip to contentSkip to conversation

iwlwifi: mvm: writing zero bytes to debugfs causes a crash

PATCH In review Dan Carpenter 2 participants 2 messages Mar 23, 2017

Subsystems (2)
Kernel janitors Intel wireless wifi link (iwlwifi)
lore
Share & tools
lore

Dan Carpenter

author
#0 lore raw

PATCH 1/1 iwlwifi: mvm: writing zero bytes to debugfs causes a crash

This is a static analysis fix. The warning is:

drivers/net/wireless/intel/iwlwifi/mvm/fw-dbg.c:912 iwl_mvm_fw_dbg_collect()
warn: integer overflows 'sizeof(*desc) + len'

I guess this code is supposed to take a NUL character, but if we write zero bytes then it tries to write -1 characters and crashes.

Fixes c91b865cb14d ("iwlwifi: mvm: support description for user triggered fw dbg collection")
Signed-off-by Dan Carpenter <[email protected]>
drivers/net/wireless/intel/iwlwifi/mvm/debugfs.c +2 -0
index a260cd503200..077bfd8f4c0c 100644
@@ -1056,6 +1056,8 @@ static ssize_t iwl_dbgfs_fw_dbg_collect_write(struct iwl_mvm *mvm,
 
 	if (ret)
 		return ret;
+	if (count = 0)
+		return 0;
 
 	iwl_mvm_fw_dbg_collect(mvm, FW_DBG_TRIGGER_USER, buf,
 			       (count - 1), NULL);
#1 lore raw
Quoted 16 lines · Dan Carpenter

This is a static analysis fix. The warning is:

drivers/net/wireless/intel/iwlwifi/mvm/fw-dbg.c:912 iwl_mvm_fw_dbg_collect()
warn: integer overflows 'sizeof(*desc) + len'

I guess this code is supposed to take a NUL character, but if we write zero bytes then it tries to write -1 characters and crashes.

Fixes c91b865cb14d ("iwlwifi: mvm: support description for user triggered fw dbg collection")
Signed-off-by Dan Carpenter <[email protected]>
drivers/net/wireless/intel/iwlwifi/mvm/debugfs.c +0 -0
index a260cd503200..077bfd8f4c0c 100644

drivers/net/wireless/intel/iwlwifi/mvm/debugfs.c static ssize_t iwl_dbgfs_fw_dbg_collect_write(struct iwl_mvm *mvm, · line 1063

Quoted 8 lines
drivers/net/wireless/intel/iwlwifi/mvm/debugfs.c +2 -0
@@ -1056,6 +1056,8 @@ static ssize_t iwl_dbgfs_fw_dbg_collect_write(struct iwl_mvm *mvm,
 
 	if (ret)
 		return ret;
+	if (count = 0)
+		return 0;
 
 	iwl_mvm_fw_dbg_collect(mvm, FW_DBG_TRIGGER_USER, buf,
 			       (count - 1), NULL);

Thanks! I'm going to push this via our internal tree.

--
Cheers,
Luca.