* [PATCH 1/3] mt76: mt7615: fix a precision vs width bug in printk
@ 2021-04-21 13:14 Dan Carpenter
2021-04-21 13:15 ` [PATCH 2/3] mt76: mt7915: " Dan Carpenter
2021-04-21 13:16 ` [PATCH 3/3] mt76: mt7921: " Dan Carpenter
0 siblings, 2 replies; 6+ messages in thread
From: Dan Carpenter @ 2021-04-21 13:14 UTC (permalink / raw)
To: Felix Fietkau
Cc: Lorenzo Bianconi, Ryder Lee, Kalle Valo, Matthias Brugger,
Sean Wang, Soul Huang, linux-wireless, linux-mediatek,
kernel-janitors
Precision "%.*s" was intended instead of width "%*s". The original code
will print garbage from beyond the end of the skb->data.
Fixes: d76d6c3ba2b0 ("mt76: mt7615: limit firmware log message printk to buffer length")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
---
drivers/net/wireless/mediatek/mt76/mt7615/mcu.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/wireless/mediatek/mt76/mt7615/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7615/mcu.c
index 9b9f8d88e9bb..00b1b657cb21 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7615/mcu.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7615/mcu.c
@@ -424,7 +424,7 @@ mt7615_mcu_rx_log_message(struct mt7615_dev *dev, struct sk_buff *skb)
break;
}
- wiphy_info(mt76_hw(dev)->wiphy, "%s: %*s", type,
+ wiphy_info(mt76_hw(dev)->wiphy, "%s: %.*s", type,
(int)(skb->len - sizeof(*rxd)), data);
}
--
2.30.2
^ permalink raw reply related [flat|nested] 6+ messages in thread
* [PATCH 2/3] mt76: mt7915: fix a precision vs width bug in printk
2021-04-21 13:14 [PATCH 1/3] mt76: mt7615: fix a precision vs width bug in printk Dan Carpenter
@ 2021-04-21 13:15 ` Dan Carpenter
2021-04-21 13:29 ` Johannes Berg
2021-04-21 13:16 ` [PATCH 3/3] mt76: mt7921: " Dan Carpenter
1 sibling, 1 reply; 6+ messages in thread
From: Dan Carpenter @ 2021-04-21 13:15 UTC (permalink / raw)
To: Felix Fietkau
Cc: Lorenzo Bianconi, Ryder Lee, Kalle Valo, Matthias Brugger,
Shayne Chen, linux-wireless, linux-mediatek, kernel-janitors
Precision %.*s was intended instead of width %.*s. The original code
will still print unintended data from beyond the end of skb->data.
Fixes: 665b2c780d63 ("mt76: mt7915: limit firmware log message printk to buffer length")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
---
drivers/net/wireless/mediatek/mt76/mt7915/mcu.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c
index 908e74a6b8e6..94195a1ad3b8 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c
@@ -521,7 +521,7 @@ mt7915_mcu_rx_log_message(struct mt7915_dev *dev, struct sk_buff *skb)
break;
}
- wiphy_info(mt76_hw(dev)->wiphy, "%s: %*s", type,
+ wiphy_info(mt76_hw(dev)->wiphy, "%s: %.*s", type,
(int)(skb->len - sizeof(*rxd)), data);
}
--
2.30.2
^ permalink raw reply related [flat|nested] 6+ messages in thread
* [PATCH 3/3] mt76: mt7921: fix a precision vs width bug in printk
2021-04-21 13:14 [PATCH 1/3] mt76: mt7615: fix a precision vs width bug in printk Dan Carpenter
2021-04-21 13:15 ` [PATCH 2/3] mt76: mt7915: " Dan Carpenter
@ 2021-04-21 13:16 ` Dan Carpenter
1 sibling, 0 replies; 6+ messages in thread
From: Dan Carpenter @ 2021-04-21 13:16 UTC (permalink / raw)
To: Felix Fietkau, Lorenzo Bianconi
Cc: Ryder Lee, Kalle Valo, Matthias Brugger, Sean Wang, Soul Huang,
linux-wireless, linux-mediatek, kernel-janitors
Precision %.*s was intended instead of width %*s. The original code
is potentially an information leak.
Fixes: c7cc5ec57303 ("mt76: mt7921: rework mt7921_mcu_debug_msg_event routine")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
---
drivers/net/wireless/mediatek/mt76/mt7921/mcu.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7921/mcu.c
index aa55667b6ed7..45ad2c337d41 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7921/mcu.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7921/mcu.c
@@ -500,7 +500,7 @@ mt7921_mcu_debug_msg_event(struct mt7921_dev *dev, struct sk_buff *skb)
if (!msg->content[i])
msg->content[i] = ' ';
}
- wiphy_info(mt76_hw(dev)->wiphy, "%*s", len, msg->content);
+ wiphy_info(mt76_hw(dev)->wiphy, "%.*s", len, msg->content);
}
}
--
2.30.2
^ permalink raw reply related [flat|nested] 6+ messages in thread
* Re: [PATCH 2/3] mt76: mt7915: fix a precision vs width bug in printk
2021-04-21 13:15 ` [PATCH 2/3] mt76: mt7915: " Dan Carpenter
@ 2021-04-21 13:29 ` Johannes Berg
2021-04-21 13:35 ` Dan Carpenter
2021-04-21 13:40 ` [PATCH 2/3 v2] " Dan Carpenter
0 siblings, 2 replies; 6+ messages in thread
From: Johannes Berg @ 2021-04-21 13:29 UTC (permalink / raw)
To: Dan Carpenter, Felix Fietkau
Cc: Lorenzo Bianconi, Ryder Lee, Kalle Valo, Matthias Brugger,
Shayne Chen, linux-wireless, linux-mediatek, kernel-janitors
On Wed, 2021-04-21 at 16:15 +0300, Dan Carpenter wrote:
> Precision %.*s was intended instead of width %.*s.
>
typo there, the second instance should say "width %*s" :-)
johannes
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH 2/3] mt76: mt7915: fix a precision vs width bug in printk
2021-04-21 13:29 ` Johannes Berg
@ 2021-04-21 13:35 ` Dan Carpenter
2021-04-21 13:40 ` [PATCH 2/3 v2] " Dan Carpenter
1 sibling, 0 replies; 6+ messages in thread
From: Dan Carpenter @ 2021-04-21 13:35 UTC (permalink / raw)
To: Johannes Berg
Cc: Felix Fietkau, Lorenzo Bianconi, Ryder Lee, Kalle Valo,
Matthias Brugger, Shayne Chen, linux-wireless, linux-mediatek,
kernel-janitors
On Wed, Apr 21, 2021 at 03:29:31PM +0200, Johannes Berg wrote:
> On Wed, 2021-04-21 at 16:15 +0300, Dan Carpenter wrote:
> > Precision %.*s was intended instead of width %.*s.
> >
>
> typo there, the second instance should say "width %*s" :-)
The hunter has become the hunted. *dramatic music. dah dah dah.*
:P
Thanks.
regards,
dan carpenter
^ permalink raw reply [flat|nested] 6+ messages in thread
* [PATCH 2/3 v2] mt76: mt7915: fix a precision vs width bug in printk
2021-04-21 13:29 ` Johannes Berg
2021-04-21 13:35 ` Dan Carpenter
@ 2021-04-21 13:40 ` Dan Carpenter
1 sibling, 0 replies; 6+ messages in thread
From: Dan Carpenter @ 2021-04-21 13:40 UTC (permalink / raw)
To: Felix Fietkau
Cc: Lorenzo Bianconi, Ryder Lee, Kalle Valo, Matthias Brugger,
Shayne Chen, linux-wireless, linux-mediatek, kernel-janitors
Precision %.*s was intended instead of width %*s. The original code
will still print unintended data from beyond the end of skb->data.
Fixes: 665b2c780d63 ("mt76: mt7915: limit firmware log message printk to buffer length")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
---
v2: fix a typo in the commit message
drivers/net/wireless/mediatek/mt76/mt7915/mcu.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c
index 908e74a6b8e6..94195a1ad3b8 100644
--- a/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c
+++ b/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c
@@ -521,7 +521,7 @@ mt7915_mcu_rx_log_message(struct mt7915_dev *dev, struct sk_buff *skb)
break;
}
- wiphy_info(mt76_hw(dev)->wiphy, "%s: %*s", type,
+ wiphy_info(mt76_hw(dev)->wiphy, "%s: %.*s", type,
(int)(skb->len - sizeof(*rxd)), data);
}
--
2.30.2
^ permalink raw reply related [flat|nested] 6+ messages in thread
end of thread, other threads:[~2021-04-21 13:40 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-04-21 13:14 [PATCH 1/3] mt76: mt7615: fix a precision vs width bug in printk Dan Carpenter
2021-04-21 13:15 ` [PATCH 2/3] mt76: mt7915: " Dan Carpenter
2021-04-21 13:29 ` Johannes Berg
2021-04-21 13:35 ` Dan Carpenter
2021-04-21 13:40 ` [PATCH 2/3 v2] " Dan Carpenter
2021-04-21 13:16 ` [PATCH 3/3] mt76: mt7921: " Dan Carpenter
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).