]> git.proxmox.com Git - mirror_ubuntu-zesty-kernel.git/commit
iwlwifi: mvm: writing zero bytes to debugfs causes a crash
authorDan Carpenter <dan.carpenter@oracle.com>
Thu, 23 Mar 2017 10:40:00 +0000 (13:40 +0300)
committerStefan Bader <stefan.bader@canonical.com>
Tue, 20 Jun 2017 08:46:19 +0000 (10:46 +0200)
commit33540f2a7a3f6ae3e1908e3679acca15340459e2
tree34c7053f35f30c4138507ced95eaa5907eb55699
parenta38773e12b3d7d1e33721b7a5cdced63afdcef19
iwlwifi: mvm: writing zero bytes to debugfs causes a crash

BugLink: http://bugs.launchpad.net/bugs/1691369
commit 251fe09f13bfb54c1ede66ee8bf8ddd0061c4f7c upstream.

This is a static analysis fix.  The warning is:

drivers/net/wireless/intel/iwlwifi/mvm/fw-dbg.c:912 iwl_mvm_fw_dbg_collect()
warn: integer overflows 'sizeof(*desc) + len'

I guess this code is supposed to take a NUL character, but if we write
zero bytes then it tries to write -1 characters and crashes.

Fixes: c91b865cb14d ("iwlwifi: mvm: support description for user triggered fw dbg collection")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Stefan Bader <stefan.bader@canonical.com>
Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@canonical.com>
drivers/net/wireless/intel/iwlwifi/mvm/debugfs.c