]>
Commit | Line | Data |
---|---|---|
b74db2ac GKH |
1 | From 251fe09f13bfb54c1ede66ee8bf8ddd0061c4f7c Mon Sep 17 00:00:00 2001 |
2 | From: Dan Carpenter <dan.carpenter@oracle.com> | |
3 | Date: Thu, 23 Mar 2017 13:40:00 +0300 | |
4 | Subject: iwlwifi: mvm: writing zero bytes to debugfs causes a crash | |
5 | ||
6 | From: Dan Carpenter <dan.carpenter@oracle.com> | |
7 | ||
8 | commit 251fe09f13bfb54c1ede66ee8bf8ddd0061c4f7c upstream. | |
9 | ||
10 | This is a static analysis fix. The warning is: | |
11 | ||
12 | drivers/net/wireless/intel/iwlwifi/mvm/fw-dbg.c:912 iwl_mvm_fw_dbg_collect() | |
13 | warn: integer overflows 'sizeof(*desc) + len' | |
14 | ||
15 | I guess this code is supposed to take a NUL character, but if we write | |
16 | zero bytes then it tries to write -1 characters and crashes. | |
17 | ||
18 | Fixes: c91b865cb14d ("iwlwifi: mvm: support description for user triggered fw dbg collection") | |
19 | Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> | |
20 | Signed-off-by: Luca Coelho <luciano.coelho@intel.com> | |
21 | Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> | |
22 | ||
23 | --- | |
24 | drivers/net/wireless/intel/iwlwifi/mvm/debugfs.c | 2 ++ | |
25 | 1 file changed, 2 insertions(+) | |
26 | ||
27 | --- a/drivers/net/wireless/intel/iwlwifi/mvm/debugfs.c | |
28 | +++ b/drivers/net/wireless/intel/iwlwifi/mvm/debugfs.c | |
29 | @@ -1056,6 +1056,8 @@ static ssize_t iwl_dbgfs_fw_dbg_collect_ | |
30 | ||
31 | if (ret) | |
32 | return ret; | |
33 | + if (count == 0) | |
34 | + return 0; | |
35 | ||
36 | iwl_mvm_fw_dbg_collect(mvm, FW_DBG_TRIGGER_USER, buf, | |
37 | (count - 1), NULL); |