bcma: fix buffer size caused crash in bcma_core_mips_print_irq()
Rafał Miłecki
maintainerPATCH 1/1 bcma: fix buffer size caused crash in bcma_core_mips_print_irq()
From: Rafał Miłecki <[email protected]>
Used buffer wasn't big enough to hold whole strings. Example output of this function is:
[ 0.180892] bcma: bus0: core 0x0800, irq: 2(S)* 3 4 5 6 D I [ 0.180948] bcma: bus0: core 0x0812, irq: 2(S) 3* 4 5 6 D I [ 0.180998] bcma: bus0: core 0x082d, irq: 2(S) 3 4* 5 6 D I [ 0.181046] bcma: bus0: core 0x082c, irq: 2(S) 3 4 5 6 D I*
which means we need to store up to 24 chars.
--- drivers/bcma/driver_mips.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/bcma/driver_mips.c +1 -1
@@ -184,7 +184,7 @@ static void bcma_core_mips_print_irq(struct bcma_device *dev, unsigned int irq) {int i;static const char *irq_name[] = {"2(S)" ,"3" ,"4" ,"5" ,"6" ,"D" ,"I" }; -char interrupts[20 ]; +char interrupts[25 ];char *ints = interrupts;for (i =0 ; i <ARRAY_SIZE (irq_name); i++)
Signature · 1 line
2.13.6
Quoted 11 lines · Rafa=C5=82 Mi=C5=82ecki <[email protected]> writes:
From: Rafa=C5=82 Mi=C5=82ecki <[email protected]>
Used buffer wasn't big enough to hold whole strings. Example output of this function is:
[ 0.180892] bcma: bus0: core 0x0800, irq: 2(S)* 3 4 5 6 D I [ 0.180948] bcma: bus0: core 0x0812, irq: 2(S) 3* 4 5 6 D I [ 0.180998] bcma: bus0: core 0x082d, irq: 2(S) 3 4* 5 6 D I [ 0.181046] bcma: bus0: core 0x082c, irq: 2(S) 3 4 5 6 D I*which means we need to store up to 24 chars.
Fixes 758f7e06063a8 ("bcma: Use bcma_debug and not pr_cont in MIPS drive=
r")
Quoted 2 lines
Signed-off-by Rafa=C5=82 Mi=C5=82ecki <[email protected]>Cc [email protected] # v4.15+
I'll queue this for 4.17.
--=20
Kalle Valo
Quoted 8 lines · Rafał Miłecki
From: Rafał Miłecki <[email protected]>
Used buffer wasn't big enough to hold whole strings. Example output of this function is:
[ 0.180892] bcma: bus0: core 0x0800, irq: 2(S)* 3 4 5 6 D I [ 0.180948] bcma: bus0: core 0x0812, irq: 2(S) 3* 4 5 6 D I [ 0.180998] bcma: bus0: core 0x082d, irq: 2(S) 3 4* 5 6 D I [ 0.181046] bcma: bus0: core 0x082c, irq: 2(S) 3 4 5 6 D I*
Quoted 5 lines
which means we need to store up to 24 chars.
Fixes 758f7e06063a8 ("bcma: Use bcma_debug and not pr_cont in MIPS driver")Signed-off-by Rafał Miłecki <[email protected]>Cc [email protected] # v4.15+
Oops. Apologies for not counting properly.
Quoted 17 lines
--- drivers/bcma/driver_mips.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)drivers/bcma/driver_mips.c +1
-1@@ -184,7 +184,7 @@ static void bcma_core_mips_print_irq(struct bcma_device *dev, unsigned int irq) {int i;static const char *irq_name[] = {"2(S)" ,"3" ,"4" ,"5" ,"6" ,"D" ,"I" }; -char interrupts[20 ]; +char interrupts[25 ];char *ints = interrupts;for (i =0 ; i <ARRAY_SIZE (irq_name); i++)
Re: [4.17] bcma: fix buffer size caused crash in bcma_core_mips_print_irq()
In reply to Rafał MiłeckiQuoted 8 lines · Rafał Miłecki
From: Rafał Miłecki <[email protected]>
Used buffer wasn't big enough to hold whole strings. Example output of this function is:
[ 0.180892] bcma: bus0: core 0x0800, irq: 2(S)* 3 4 5 6 D I [ 0.180948] bcma: bus0: core 0x0812, irq: 2(S) 3* 4 5 6 D I [ 0.180998] bcma: bus0: core 0x082d, irq: 2(S) 3 4* 5 6 D I [ 0.181046] bcma: bus0: core 0x082c, irq: 2(S) 3 4 5 6 D I*
Quoted 5 lines
which means we need to store up to 24 chars.
Fixes 758f7e06063a8 ("bcma: Use bcma_debug and not pr_cont in MIPS driver")Signed-off-by Rafał Miłecki <[email protected]>Cc [email protected] # v4.15+
Patch applied to wireless-drivers.git, thanks.
361de091a4b9 bcma: fix buffer size caused crash in bcma_core_mips_print_irq()
Signature · 3 lines
https://patchwork.kernel.org/patch/10385861/ https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches