From patchwork Tue May 8 09:31:04 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: =?utf-8?b?UmFmYcWCIE1pxYJlY2tp?= X-Patchwork-Id: 10385861 X-Patchwork-Delegate: kvalo@adurom.com Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 3A7CA602C2 for ; Tue, 8 May 2018 09:32:05 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 28E0928C56 for ; Tue, 8 May 2018 09:32:05 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 1D17128C5B; Tue, 8 May 2018 09:32:05 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-8.0 required=2.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, FREEMAIL_FROM, MAILING_LIST_MULTI, RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 2887028C56 for ; Tue, 8 May 2018 09:32:04 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754802AbeEHJcC (ORCPT ); Tue, 8 May 2018 05:32:02 -0400 Received: from mail-lf0-f65.google.com ([209.85.215.65]:37257 "EHLO mail-lf0-f65.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754457AbeEHJcA (ORCPT ); Tue, 8 May 2018 05:32:00 -0400 Received: by mail-lf0-f65.google.com with SMTP id r2-v6so8698890lff.4 for ; Tue, 08 May 2018 02:32:00 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding; bh=0wtRTIuAb/vGvDABIsDEGp/F7WmyDa1tBBoXZ/vgu+M=; b=kPVS5S74YMBnVqquoylXde5kbxbd8mQ8HsgXQVBa4yd92RwIeCQgxPjwmK95rnsMSs nIv35NEx9fBORpkwqNpOxsLKZYVHRsEurmRZm3F8ZSWsSeXpPOF45pmNpZkh4g/E4Zhr W8H+M6q2j1R1pH07Qv+OCjt5LvUqYS7facTGLk7XwGE8Y2Q7seLBLLhtqU3490RlO8p1 I1pPAmImNn7R7PmZ8gxzsJ/DJaFU+Dgb8IdRIkmqseVZPvXmFWcqDzOrgU6C6EwTSFnq fxEI7tIhKH0IYjstv7pQt1qcJaRrcHVDRSuf3DclD1mEHyLjAm9s7661B/3NtGkQFlrs n6qQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding; bh=0wtRTIuAb/vGvDABIsDEGp/F7WmyDa1tBBoXZ/vgu+M=; b=QJ4VbcjbtuKOm+YHsf2cFufN2+kQRpSA6nX1xMd77jd0gmORRgOKScc4q59x/pTuFN z2Uk3upP1xjiosN5u1evrEzvX03Yw2/4EAp+SAUpzlu8/dVVbzwCrH1yaKxQvD7uon3r iT+uoMnQtGnjeeMMEZQ4ALe/RR4zkua06/OnPTHBUmZcF0kfEJ+95wLd/IYpdmYtT4DX TMQocEZKdWajvAoGPxW2sb70EhquwuaN4MTdZytgsH1vs8BqowIdT+etw4t6KTweJi9F 68N4knV3NfWXG4N2SW+0l/iwPoeI0v4sXaDRP9s8Pd8YsFAYQ89+i4sRmLeVVaIwDP/A cXgQ== X-Gm-Message-State: ALKqPwfly7wvVDTusq61MYQgZXXCGLHJvsIpw+T9j/9GR7tSL6FNu+kQ +JlGFR91iMwJ2siKFudrjME= X-Google-Smtp-Source: AB8JxZrIFu58nJfPWRGqDTii0ZuWlEqUWqoyhJ65xnyoN/6VIXPiHIF2OM3Dp9H8XDX33ne+LEGZjA== X-Received: by 2002:a19:1256:: with SMTP id h83-v6mr7338714lfi.86.1525771919356; Tue, 08 May 2018 02:31:59 -0700 (PDT) Received: from linux-veee.lan (ip-194-187-74-233.konfederacka.maverick.com.pl. [194.187.74.233]) by smtp.gmail.com with ESMTPSA id e24-v6sm5246698lfb.54.2018.05.08.02.31.58 (version=TLS1_2 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Tue, 08 May 2018 02:31:58 -0700 (PDT) From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= To: Kalle Valo Cc: linux-wireless@vger.kernel.org, Hauke Mehrtens , Joe Perches , =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= Subject: [PATCH 4.17] bcma: fix buffer size caused crash in bcma_core_mips_print_irq() Date: Tue, 8 May 2018 11:31:04 +0200 Message-Id: <20180508093104.27018-1-zajec5@gmail.com> X-Mailer: git-send-email 2.13.6 MIME-Version: 1.0 Sender: linux-wireless-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-wireless@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP From: Rafał Miłecki Used buffer wasn't big enough to hold whole strings. Example output of this function is: [ 0.180892] bcma: bus0: core 0x0800, irq: 2(S)* 3 4 5 6 D I [ 0.180948] bcma: bus0: core 0x0812, irq: 2(S) 3* 4 5 6 D I [ 0.180998] bcma: bus0: core 0x082d, irq: 2(S) 3 4* 5 6 D I [ 0.181046] bcma: bus0: core 0x082c, irq: 2(S) 3 4 5 6 D I* which means we need to store up to 24 chars. Fixes: 758f7e06063a8 ("bcma: Use bcma_debug and not pr_cont in MIPS driver") Signed-off-by: Rafał Miłecki Cc: stable@vger.kernel.org # v4.15+ --- drivers/bcma/driver_mips.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/bcma/driver_mips.c b/drivers/bcma/driver_mips.c index f040aba48d50..27e9686b6d3a 100644 --- a/drivers/bcma/driver_mips.c +++ b/drivers/bcma/driver_mips.c @@ -184,7 +184,7 @@ static void bcma_core_mips_print_irq(struct bcma_device *dev, unsigned int irq) { int i; static const char *irq_name[] = {"2(S)", "3", "4", "5", "6", "D", "I"}; - char interrupts[20]; + char interrupts[25]; char *ints = interrupts; for (i = 0; i < ARRAY_SIZE(irq_name); i++)