From: Rafał Miłecki Date: Tue, 8 May 2018 09:31:04 +0000 (+0200) Subject: bcma: fix buffer size caused crash in bcma_core_mips_print_irq() X-Git-Tag: Ubuntu-4.15.0-34.37~29 X-Git-Url: https://git.proxmox.com/?a=commitdiff_plain;ds=sidebyside;h=ed1fe53e80e2c6215eff57a757817c5d0c3c8ca0;p=mirror_ubuntu-bionic-kernel.git bcma: fix buffer size caused crash in bcma_core_mips_print_irq() BugLink: http://bugs.launchpad.net/bugs/1786352 commit 361de091a4b97aa9081d304d742f80d486ab7125 upstream. Used buffer wasn't big enough to hold whole strings. Example output of this function is: [ 0.180892] bcma: bus0: core 0x0800, irq: 2(S)* 3 4 5 6 D I [ 0.180948] bcma: bus0: core 0x0812, irq: 2(S) 3* 4 5 6 D I [ 0.180998] bcma: bus0: core 0x082d, irq: 2(S) 3 4* 5 6 D I [ 0.181046] bcma: bus0: core 0x082c, irq: 2(S) 3 4 5 6 D I* which means we need to store up to 24 chars. Fixes: 758f7e06063a8 ("bcma: Use bcma_debug and not pr_cont in MIPS driver") Signed-off-by: Rafał Miłecki Cc: stable@vger.kernel.org # v4.15+ Signed-off-by: Kalle Valo Signed-off-by: Greg Kroah-Hartman Signed-off-by: Kamal Mostafa Signed-off-by: Khalid Elmously --- diff --git a/drivers/bcma/driver_mips.c b/drivers/bcma/driver_mips.c index f040aba48d50..27e9686b6d3a 100644 --- a/drivers/bcma/driver_mips.c +++ b/drivers/bcma/driver_mips.c @@ -184,7 +184,7 @@ static void bcma_core_mips_print_irq(struct bcma_device *dev, unsigned int irq) { int i; static const char *irq_name[] = {"2(S)", "3", "4", "5", "6", "D", "I"}; - char interrupts[20]; + char interrupts[25]; char *ints = interrupts; for (i = 0; i < ARRAY_SIZE(irq_name); i++)