Commit ada577c1 authored by Eliad Peller's avatar Eliad Peller Committed by John W. Linville

mac80211: add NULL terminator to debugfs_netdev write buf

Some debugfs write functions call kstrto* functions, which
assume the string is null-terminated. Make it valid by changing
ieee80211_if_write() to use static buffer instead of allocating
one, and set the last char to NULL.

(The write functions try to parse some integer/mac address,
so 64 bytes buffer should be enough)
Signed-off-by: default avatarEliad Peller <eliad@wizery.com>
Signed-off-by: default avatarJohn W. Linville <linville@tuxdriver.com>
parent ba6fa29c
...@@ -49,16 +49,15 @@ static ssize_t ieee80211_if_write( ...@@ -49,16 +49,15 @@ static ssize_t ieee80211_if_write(
size_t count, loff_t *ppos, size_t count, loff_t *ppos,
ssize_t (*write)(struct ieee80211_sub_if_data *, const char *, int)) ssize_t (*write)(struct ieee80211_sub_if_data *, const char *, int))
{ {
u8 *buf; char buf[64];
ssize_t ret; ssize_t ret;
buf = kmalloc(count, GFP_KERNEL); if (count >= sizeof(buf))
if (!buf) return -E2BIG;
return -ENOMEM;
ret = -EFAULT;
if (copy_from_user(buf, userbuf, count)) if (copy_from_user(buf, userbuf, count))
goto freebuf; return -EFAULT;
buf[count] = '\0';
ret = -ENODEV; ret = -ENODEV;
rtnl_lock(); rtnl_lock();
...@@ -66,8 +65,6 @@ static ssize_t ieee80211_if_write( ...@@ -66,8 +65,6 @@ static ssize_t ieee80211_if_write(
ret = (*write)(sdata, buf, count); ret = (*write)(sdata, buf, count);
rtnl_unlock(); rtnl_unlock();
freebuf:
kfree(buf);
return ret; return ret;
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment