| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Mon, 12 Aug 2013 01:39:32 +0100
From: Djalal Harouni <tixxdz@...ndz.org>
To: Johannes Berg <johannes.berg@...el.com>,
Emmanuel Grumbach <emmanuel.grumbach@...el.com>,
Intel Linux Wireless <ilw@...ux.intel.com>,
"John W. Linville" <linville@...driver.com>,
linux-kernel@...r.kernel.org
Cc: Djalal Harouni <tixxdz@...ndz.org>, stable@...r.kernel.org
Subject: [PATCH] iwlwifi: mvm: make debugfs write() operations write up to count bytes
Some debugfs write() operations of the MVM Firmware will ignore the
count argument, and will copy more bytes than what was specified.
Fix this by getting the right count of bytes.
This will also honor restrictions put on the number of bytes to write.
To be consitant this patch also switches the initializer from
'char buf[x] = {}' to the explicit memset() as it is done in other
places of the same file.
Cc: stable@...r.kernel.org
Signed-off-by: Djalal Harouni <tixxdz@...ndz.org>
---
Patch compile tested only.
Dual BSD/GPLv2 license: Ok
drivers/net/wireless/iwlwifi/mvm/debugfs.c | 28 ++++++++++++++++++++--------
1 file changed, 20 insertions(+), 8 deletions(-)
diff --git a/drivers/net/wireless/iwlwifi/mvm/debugfs.c b/drivers/net/wireless/iwlwifi/mvm/debugfs.c
index 56f6827..ca368db 100644
--- a/drivers/net/wireless/iwlwifi/mvm/debugfs.c
+++ b/drivers/net/wireless/iwlwifi/mvm/debugfs.c
@@ -251,13 +251,16 @@ static ssize_t iwl_dbgfs_power_down_allow_write(struct file *file,
size_t count, loff_t *ppos)
{
struct iwl_mvm *mvm = file->private_data;
- char buf[8] = {};
+ char buf[8];
int allow;
if (!mvm->ucode_loaded)
return -EIO;
- if (copy_from_user(buf, user_buf, sizeof(buf)))
+ memset(buf, 0, sizeof(buf));
+ if (count > sizeof(buf) - 1)
+ count = sizeof(buf) - 1;
+ if (copy_from_user(buf, user_buf, count))
return -EFAULT;
if (sscanf(buf, "%d", &allow) != 1)
@@ -278,10 +281,13 @@ static ssize_t iwl_dbgfs_power_down_d3_allow_write(struct file *file,
size_t count, loff_t *ppos)
{
struct iwl_mvm *mvm = file->private_data;
- char buf[8] = {};
+ char buf[8];
int allow;
- if (copy_from_user(buf, user_buf, sizeof(buf)))
+ memset(buf, 0, sizeof(buf));
+ if (count > sizeof(buf) - 1)
+ count = sizeof(buf) - 1;
+ if (copy_from_user(buf, user_buf, count))
return -EFAULT;
if (sscanf(buf, "%d", &allow) != 1)
@@ -363,11 +369,14 @@ static ssize_t iwl_dbgfs_pm_params_write(struct file *file,
struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
struct iwl_mvm *mvm = mvmvif->dbgfs_data;
enum iwl_dbgfs_pm_mask param;
- char buf[32] = {};
+ char buf[32];
int val;
int ret;
- if (copy_from_user(buf, user_buf, sizeof(buf)))
+ memset(buf, 0, sizeof(buf));
+ if (count > sizeof(buf) - 1)
+ count = sizeof(buf) - 1;
+ if (copy_from_user(buf, user_buf, count))
return -EFAULT;
if (!strncmp("keep_alive=", buf, 11)) {
@@ -824,10 +833,13 @@ static ssize_t iwl_dbgfs_d3_sram_write(struct file *file,
size_t count, loff_t *ppos)
{
struct iwl_mvm *mvm = file->private_data;
- char buf[8] = {};
+ char buf[8];
int store;
- if (copy_from_user(buf, user_buf, sizeof(buf)))
+ memset(buf, 0, sizeof(buf));
+ if (count > sizeof(buf) - 1)
+ count = sizeof(buf) - 1;
+ if (copy_from_user(buf, user_buf, count))
return -EFAULT;
if (sscanf(buf, "%d", &store) != 1)
--
1.7.11.7
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists