Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1285398

[PATCH 3.14 23/37] mwifiex: fix mwifiex_rdeeprom_read()

Show all headers | View raw

3.14-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Dan Carpenter <dan.carpenter@oracle.com>

commit 1f9c6e1bc1ba5f8a10fcd6e99d170954d7c6d382 upstream.

There were several bugs here.

1)  The done label was in the wrong place so we didn't copy any
    information out when there was no command given.

2)  We were using PAGE_SIZE as the size of the buffer instead of
    "PAGE_SIZE - pos".

3)  snprintf() returns the number of characters that would have been
    printed if there were enough space.  If there was not enough space
    (and we had fixed the memory corruption bug #2) then it would result
    in an information leak when we do simple_read_from_buffer().  I've
    changed it to use scnprintf() instead.

I also removed the initialization at the start of the function, because
I thought it made the code a little more clear.

Fixes: 5e6e3a92b9a4 ('wireless: mwifiex: initial commit for Marvell mwifiex driver')
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Amitkumar Karwar <akarwar@marvell.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 drivers/net/wireless/mwifiex/debugfs.c |   14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

--- a/drivers/net/wireless/mwifiex/debugfs.c
+++ b/drivers/net/wireless/mwifiex/debugfs.c
@@ -637,7 +637,7 @@ mwifiex_rdeeprom_read(struct file *file,
 		(struct mwifiex_private *) file->private_data;
 	unsigned long addr = get_zeroed_page(GFP_KERNEL);
 	char *buf = (char *) addr;
-	int pos = 0, ret = 0, i;
+	int pos, ret, i;
 	u8 value[MAX_EEPROM_DATA];
 
 	if (!buf)
@@ -645,7 +645,7 @@ mwifiex_rdeeprom_read(struct file *file,
 
 	if (saved_offset == -1) {
 		/* No command has been given */
-		pos += snprintf(buf, PAGE_SIZE, "0");
+		pos = snprintf(buf, PAGE_SIZE, "0");
 		goto done;
 	}
 
@@ -654,17 +654,17 @@ mwifiex_rdeeprom_read(struct file *file,
 				  (u16) saved_bytes, value);
 	if (ret) {
 		ret = -EINVAL;
-		goto done;
+		goto out_free;
 	}
 
-	pos += snprintf(buf, PAGE_SIZE, "%d %d ", saved_offset, saved_bytes);
+	pos = snprintf(buf, PAGE_SIZE, "%d %d ", saved_offset, saved_bytes);
 
 	for (i = 0; i < saved_bytes; i++)
-		pos += snprintf(buf + strlen(buf), PAGE_SIZE, "%d ", value[i]);
-
-	ret = simple_read_from_buffer(ubuf, count, ppos, buf, pos);
+		pos += scnprintf(buf + pos, PAGE_SIZE - pos, "%d ", value[i]);
 
 done:
+	ret = simple_read_from_buffer(ubuf, count, ppos, buf, pos);
+out_free:
 	free_page(addr);
 	return ret;
 }


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH 3.14 00/37] 3.14.58-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-12-07 15:30 +0100
  [PATCH 3.14 24/37] staging: rtl8712: Add device ID for Sitecom WLA2100 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-12-07 15:30 +0100
  [PATCH 3.14 03/37] ppp: fix pppoe_dev deletion condition in pppoe_release() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-12-07 15:30 +0100
  [PATCH 3.14 21/37] mac80211: fix driver RSSI event calculations Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-12-07 15:30 +0100
  [PATCH 3.14 18/37] x86/setup: Fix low identity map for >= 2GB kernel range Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-12-07 15:30 +0100
  [PATCH 3.14 35/37] ALSA: usb-audio: add packet size quirk for the Medeli DD305 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-12-07 15:30 +0100
  [PATCH 3.14 20/37] x86/cpu: Fix SMAP check in PVOPS environments Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-12-07 15:30 +0100
  [PATCH 3.14 25/37] Bluetooth: hidp: fix device disconnect on idle timeout Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-12-07 15:30 +0100
  [PATCH 3.14 07/37] ipmr: fix possible race resulting from improper usage of IP_INC_STATS_BH() in preemptible context. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-12-07 15:30 +0100
  [PATCH 3.14 23/37] mwifiex: fix mwifiex_rdeeprom_read() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-12-07 15:30 +0100
  [PATCH 3.14 26/37] Bluetooth: ath3k: Add new AR3012 0930:021c id Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-12-07 15:40 +0100
  [PATCH 3.14 14/37] ARM: 8427/1: dma-mapping: add support for offset parameter in dma_mmap() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-12-07 15:40 +0100
  [PATCH 3.14 16/37] ARM: common: edma: Fix channel parameter for irq callbacks Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-12-07 15:40 +0100
  [PATCH 3.14 37/37] ALSA: usb-audio: work around CH345 input SysEx corruption Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-12-07 15:40 +0100
  [PATCH 3.14 28/37] can: sja1000: clear interrupts on start Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-12-07 15:40 +0100
  [PATCH 3.14 04/37] RDS-TCP: Recover correctly from pskb_pull()/pksb_trim() failure in rds_tcp_data_recv Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-12-07 15:40 +0100
  [PATCH 3.14 09/37] packet: race condition in packet_bind Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-12-07 15:40 +0100
  [PATCH 3.14 02/37] macvtap: unbreak receiving of gro skb with frag list Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-12-07 15:40 +0100
  [PATCH 3.14 17/37] x86/setup: Extend low identity map to cover whole kernel range Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-12-07 15:40 +0100
  [PATCH 3.14 27/37] Bluetooth: ath3k: Add support of AR3012 0cf3:817b device Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-12-07 15:40 +0100
  [PATCH 3.14 36/37] ALSA: usb-audio: prevent CH345 multiport output SysEx corruption Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-12-07 15:40 +0100
  [PATCH 3.14 06/37] stmmac: Correctly report PTP capabilities. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-12-07 15:40 +0100
  [PATCH 3.14 13/37] ARM: 8426/1: dma-mapping: add missing range check in dma_mmap() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-12-07 15:40 +0100
  [PATCH 3.14 08/37] net: avoid NULL deref in inet_ctl_sock_destroy() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-12-07 15:40 +0100
  [PATCH 3.14 29/37] arm64: Fix compat register mappings Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-12-07 15:40 +0100
  [PATCH 3.14 05/37] net/mlx4: Copy/set only sizeof struct mlx4_eqe bytes Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-12-07 15:40 +0100
  [PATCH 3.14 30/37] usblp: do not set TASK_INTERRUPTIBLE before lock Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-12-07 15:40 +0100
  [PATCH 3.14 12/37] RDS: verify the underlying transport exists before creating a connection Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-12-07 17:30 +0100
  [PATCH 3.14 11/37] virtio-net: drop NETIF_F_FRAGLIST Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-12-07 17:30 +0100
  Re: [PATCH 3.14 00/37] 3.14.58-stable review Shuah Khan <shuahkh@osg.samsung.com> - 2015-12-07 18:20 +0100
  Re: [PATCH 3.14 00/37] 3.14.58-stable review Guenter Roeck <linux@roeck-us.net> - 2015-12-07 22:20 +0100
    Re: [PATCH 3.14 00/37] 3.14.58-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-12-09 04:30 +0100

csiph-web