* [PATCH 4.17] bcma: fix buffer size caused crash in bcma_core_mips_print_irq()
@ 2018-05-08 9:31 Rafał Miłecki
2018-05-08 10:06 ` Kalle Valo
` (2 more replies)
0 siblings, 3 replies; 4+ messages in thread
From: Rafał Miłecki @ 2018-05-08 9:31 UTC (permalink / raw)
To: Kalle Valo
Cc: linux-wireless, Hauke Mehrtens, Joe Perches, Rafał Miłecki
From: Rafał Miłecki <rafal@milecki.pl>
Used buffer wasn't big enough to hold whole strings. Example output of
this function is:
[ 0.180892] bcma: bus0: core 0x0800, irq: 2(S)* 3 4 5 6 D I
[ 0.180948] bcma: bus0: core 0x0812, irq: 2(S) 3* 4 5 6 D I
[ 0.180998] bcma: bus0: core 0x082d, irq: 2(S) 3 4* 5 6 D I
[ 0.181046] bcma: bus0: core 0x082c, irq: 2(S) 3 4 5 6 D I*
which means we need to store up to 24 chars.
Fixes: 758f7e06063a8 ("bcma: Use bcma_debug and not pr_cont in MIPS driver")
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
Cc: stable@vger.kernel.org # v4.15+
---
drivers/bcma/driver_mips.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/bcma/driver_mips.c b/drivers/bcma/driver_mips.c
index f040aba48d50..27e9686b6d3a 100644
--- a/drivers/bcma/driver_mips.c
+++ b/drivers/bcma/driver_mips.c
@@ -184,7 +184,7 @@ static void bcma_core_mips_print_irq(struct bcma_device *dev, unsigned int irq)
{
int i;
static const char *irq_name[] = {"2(S)", "3", "4", "5", "6", "D", "I"};
- char interrupts[20];
+ char interrupts[25];
char *ints = interrupts;
for (i = 0; i < ARRAY_SIZE(irq_name); i++)
--
2.13.6
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [PATCH 4.17] bcma: fix buffer size caused crash in bcma_core_mips_print_irq()
2018-05-08 9:31 [PATCH 4.17] bcma: fix buffer size caused crash in bcma_core_mips_print_irq() Rafał Miłecki
@ 2018-05-08 10:06 ` Kalle Valo
2018-05-08 16:47 ` Joe Perches
2018-05-12 8:37 ` [4.17] " Kalle Valo
2 siblings, 0 replies; 4+ messages in thread
From: Kalle Valo @ 2018-05-08 10:06 UTC (permalink / raw)
To: Rafał Miłecki
Cc: linux-wireless, Hauke Mehrtens, Joe Perches, Rafał Miłecki
Rafa=C5=82 Mi=C5=82ecki <zajec5@gmail.com> writes:
> From: Rafa=C5=82 Mi=C5=82ecki <rafal@milecki.pl>
>
> Used buffer wasn't big enough to hold whole strings. Example output of
> this function is:
> [ 0.180892] bcma: bus0: core 0x0800, irq: 2(S)* 3 4 5 6 D I
> [ 0.180948] bcma: bus0: core 0x0812, irq: 2(S) 3* 4 5 6 D I
> [ 0.180998] bcma: bus0: core 0x082d, irq: 2(S) 3 4* 5 6 D I
> [ 0.181046] bcma: bus0: core 0x082c, irq: 2(S) 3 4 5 6 D I*
> which means we need to store up to 24 chars.
>
> Fixes: 758f7e06063a8 ("bcma: Use bcma_debug and not pr_cont in MIPS drive=
r")
> Signed-off-by: Rafa=C5=82 Mi=C5=82ecki <rafal@milecki.pl>
> Cc: stable@vger.kernel.org # v4.15+
I'll queue this for 4.17.
--=20
Kalle Valo
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH 4.17] bcma: fix buffer size caused crash in bcma_core_mips_print_irq()
2018-05-08 9:31 [PATCH 4.17] bcma: fix buffer size caused crash in bcma_core_mips_print_irq() Rafał Miłecki
2018-05-08 10:06 ` Kalle Valo
@ 2018-05-08 16:47 ` Joe Perches
2018-05-12 8:37 ` [4.17] " Kalle Valo
2 siblings, 0 replies; 4+ messages in thread
From: Joe Perches @ 2018-05-08 16:47 UTC (permalink / raw)
To: Rafał Miłecki, Kalle Valo
Cc: linux-wireless, Hauke Mehrtens, Rafał Miłecki
On Tue, 2018-05-08 at 11:31 +0200, Rafał Miłecki wrote:
> From: Rafał Miłecki <rafal@milecki.pl>
>
> Used buffer wasn't big enough to hold whole strings. Example output of
> this function is:
> [ 0.180892] bcma: bus0: core 0x0800, irq: 2(S)* 3 4 5 6 D I
> [ 0.180948] bcma: bus0: core 0x0812, irq: 2(S) 3* 4 5 6 D I
> [ 0.180998] bcma: bus0: core 0x082d, irq: 2(S) 3 4* 5 6 D I
> [ 0.181046] bcma: bus0: core 0x082c, irq: 2(S) 3 4 5 6 D I*
> which means we need to store up to 24 chars.
>
> Fixes: 758f7e06063a8 ("bcma: Use bcma_debug and not pr_cont in MIPS driver")
> Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
> Cc: stable@vger.kernel.org # v4.15+
Oops. Apologies for not counting properly.
> ---
> drivers/bcma/driver_mips.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/bcma/driver_mips.c b/drivers/bcma/driver_mips.c
> index f040aba48d50..27e9686b6d3a 100644
> --- a/drivers/bcma/driver_mips.c
> +++ b/drivers/bcma/driver_mips.c
> @@ -184,7 +184,7 @@ static void bcma_core_mips_print_irq(struct bcma_device *dev, unsigned int irq)
> {
> int i;
> static const char *irq_name[] = {"2(S)", "3", "4", "5", "6", "D", "I"};
> - char interrupts[20];
> + char interrupts[25];
> char *ints = interrupts;
>
> for (i = 0; i < ARRAY_SIZE(irq_name); i++)
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [4.17] bcma: fix buffer size caused crash in bcma_core_mips_print_irq()
2018-05-08 9:31 [PATCH 4.17] bcma: fix buffer size caused crash in bcma_core_mips_print_irq() Rafał Miłecki
2018-05-08 10:06 ` Kalle Valo
2018-05-08 16:47 ` Joe Perches
@ 2018-05-12 8:37 ` Kalle Valo
2 siblings, 0 replies; 4+ messages in thread
From: Kalle Valo @ 2018-05-12 8:37 UTC (permalink / raw)
To: Rafał Miłecki
Cc: linux-wireless, Hauke Mehrtens, Joe Perches, Rafał Miłecki
Rafał Miłecki wrote:
> From: Rafał Miłecki <rafal@milecki.pl>
>
> Used buffer wasn't big enough to hold whole strings. Example output of
> this function is:
> [ 0.180892] bcma: bus0: core 0x0800, irq: 2(S)* 3 4 5 6 D I
> [ 0.180948] bcma: bus0: core 0x0812, irq: 2(S) 3* 4 5 6 D I
> [ 0.180998] bcma: bus0: core 0x082d, irq: 2(S) 3 4* 5 6 D I
> [ 0.181046] bcma: bus0: core 0x082c, irq: 2(S) 3 4 5 6 D I*
> which means we need to store up to 24 chars.
>
> Fixes: 758f7e06063a8 ("bcma: Use bcma_debug and not pr_cont in MIPS driver")
> Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
> Cc: stable@vger.kernel.org # v4.15+
Patch applied to wireless-drivers.git, thanks.
361de091a4b9 bcma: fix buffer size caused crash in bcma_core_mips_print_irq()
--
https://patchwork.kernel.org/patch/10385861/
https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2018-05-12 8:37 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2018-05-08 9:31 [PATCH 4.17] bcma: fix buffer size caused crash in bcma_core_mips_print_irq() Rafał Miłecki
2018-05-08 10:06 ` Kalle Valo
2018-05-08 16:47 ` Joe Perches
2018-05-12 8:37 ` [4.17] " Kalle Valo
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.