| Message ID | 20131029190641.GB21820@longonot.mountain (mailing list archive) |
|---|---|
| State | Not Applicable, archived |
| Headers | show |
On Tue, Oct 29, 2013 at 10:06:41PM +0300, Dan Carpenter wrote: > If we do a zero size write then it will oops. This can only be > triggered by root. > This one isn't right... Sorry for that. We do need to fix the while loop. I wasn't thinking. I will resend. regards, dan carpenter -- To unsubscribe from this list: send the line "unsubscribe linux-wireless" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
diff --git a/drivers/net/wireless/libertas/debugfs.c b/drivers/net/wireless/libertas/debugfs.c index 668dd27..a148f14 100644 --- a/drivers/net/wireless/libertas/debugfs.c +++ b/drivers/net/wireless/libertas/debugfs.c @@ -913,6 +913,9 @@ static ssize_t lbs_debugfs_write(struct file *f, const char __user *buf, char *p2; struct debug_data *d = f->private_data; + if (cnt == 0) + return 0; + pdata = kmalloc(cnt, GFP_KERNEL); if (pdata == NULL) return 0;
If we do a zero size write then it will oops. This can only be triggered by root. Reported-by: Nico Golde <nico@ngolde.de> Reported-by: Fabian Yamaguchi <fabs@goesec.de> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> -- To unsubscribe from this list: send the line "unsubscribe linux-wireless" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html