* [PATCH] iwlwifi: mvm: writing zero bytes to debugfs causes a crash
@ 2017-03-23 10:40 Dan Carpenter
2017-03-23 12:25 ` Luca Coelho
0 siblings, 1 reply; 2+ messages in thread
From: Dan Carpenter @ 2017-03-23 10:40 UTC (permalink / raw)
To: Johannes Berg, Golan Ben-Ami
Cc: Emmanuel Grumbach, Luca Coelho, Intel Linux Wireless, Kalle Valo,
Sara Sharon, Ido Yariv, linux-wireless, kernel-janitors
This is a static analysis fix. The warning is:
drivers/net/wireless/intel/iwlwifi/mvm/fw-dbg.c:912 iwl_mvm_fw_dbg_collect()
warn: integer overflows 'sizeof(*desc) + len'
I guess this code is supposed to take a NUL character, but if we write
zero bytes then it tries to write -1 characters and crashes.
Fixes: c91b865cb14d ("iwlwifi: mvm: support description for user triggered fw dbg collection")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/debugfs.c b/drivers/net/wireless/intel/iwlwifi/mvm/debugfs.c
index a260cd503200..077bfd8f4c0c 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/debugfs.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/debugfs.c
@@ -1056,6 +1056,8 @@ static ssize_t iwl_dbgfs_fw_dbg_collect_write(struct iwl_mvm *mvm,
if (ret)
return ret;
+ if (count = 0)
+ return 0;
iwl_mvm_fw_dbg_collect(mvm, FW_DBG_TRIGGER_USER, buf,
(count - 1), NULL);
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH] iwlwifi: mvm: writing zero bytes to debugfs causes a crash
2017-03-23 10:40 [PATCH] iwlwifi: mvm: writing zero bytes to debugfs causes a crash Dan Carpenter
@ 2017-03-23 12:25 ` Luca Coelho
0 siblings, 0 replies; 2+ messages in thread
From: Luca Coelho @ 2017-03-23 12:25 UTC (permalink / raw)
To: Dan Carpenter, Johannes Berg, Golan Ben-Ami
Cc: Emmanuel Grumbach, Intel Linux Wireless, Kalle Valo, Sara Sharon,
Ido Yariv, linux-wireless, kernel-janitors
On Thu, 2017-03-23 at 13:40 +0300, Dan Carpenter wrote:
> This is a static analysis fix. The warning is:
>
> drivers/net/wireless/intel/iwlwifi/mvm/fw-dbg.c:912 iwl_mvm_fw_dbg_collect()
> warn: integer overflows 'sizeof(*desc) + len'
>
> I guess this code is supposed to take a NUL character, but if we write
> zero bytes then it tries to write -1 characters and crashes.
>
> Fixes: c91b865cb14d ("iwlwifi: mvm: support description for user triggered fw dbg collection")
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
>
> diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/debugfs.c b/drivers/net/wireless/intel/iwlwifi/mvm/debugfs.c
> index a260cd503200..077bfd8f4c0c 100644
> --- a/drivers/net/wireless/intel/iwlwifi/mvm/debugfs.c
> +++ b/drivers/net/wireless/intel/iwlwifi/mvm/debugfs.c
> @@ -1056,6 +1056,8 @@ static ssize_t iwl_dbgfs_fw_dbg_collect_write(struct iwl_mvm *mvm,
>
> if (ret)
> return ret;
> + if (count = 0)
> + return 0;
>
> iwl_mvm_fw_dbg_collect(mvm, FW_DBG_TRIGGER_USER, buf,
> (count - 1), NULL);
Thanks! I'm going to push this via our internal tree.
--
Cheers,
Luca.
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2017-03-23 12:25 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2017-03-23 10:40 [PATCH] iwlwifi: mvm: writing zero bytes to debugfs causes a crash Dan Carpenter
2017-03-23 12:25 ` Luca Coelho
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox