[PATCH] mac80211: debugfs: bound queue state formatting to PAGE_SIZE

[Pengpeng Hou <pengpeng@iscas.ac.cn>]

queues_read() formats all queue state lines into a fixed stack buffer
that budgets only 20 bytes per queue and appends each line with
sprintf().

The queue-stop reason bitmap is printed with %#.8lx, whose width is not
capped on 64-bit builds, and the pending queue length field can add more
digits still. The cumulative output can therefore run past the end of
the fixed stack buffer.

Format the output into a PAGE_SIZE heap buffer with scnprintf() and stop
once the debugfs read buffer is full.

Fixes: db2e6bd4e966 ("mac80211: add queue debugfs file")

Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
---
 net/mac80211/debugfs.c | 22 +++++++++++++++-------
 1 file changed, 15 insertions(+), 7 deletions(-)

diff --git a/net/mac80211/debugfs.c b/net/mac80211/debugfs.c
index 5a1831b08677..2cf6342d28db 100644
--- a/net/mac80211/debugfs.c
+++ b/net/mac80211/debugfs.c
@@ -9,6 +9,7 @@
 
 #include <linux/debugfs.h>
 #include <linux/rtnetlink.h>
+#include <linux/slab.h>
 #include <linux/vmalloc.h>
 #include "ieee80211_i.h"
 #include "driver-ops.h"
@@ -596,17 +597,24 @@ static ssize_t queues_read(struct file *file, char __user *user_buf,
 {
 	struct ieee80211_local *local = file->private_data;
 	unsigned long flags;
-	char buf[IEEE80211_MAX_QUEUES * 20];
-	int q, res = 0;
+	char *buf;
+	int q, res = 0, ret;
+
+	buf = kmalloc(PAGE_SIZE, GFP_KERNEL);
+	if (!buf)
+		return -ENOMEM;
 
 	spin_lock_irqsave(&local->queue_stop_reason_lock, flags);
-	for (q = 0; q < local->hw.queues; q++)
-		res += sprintf(buf + res, "%02d: %#.8lx/%d\n", q,
-				local->queue_stop_reasons[q],
-				skb_queue_len(&local->pending[q]));
+	for (q = 0; q < local->hw.queues && res < PAGE_SIZE; q++)
+		res += scnprintf(buf + res, PAGE_SIZE - res,
+				 "%02d: %#.8lx/%d\n", q,
+				 local->queue_stop_reasons[q],
+				 skb_queue_len(&local->pending[q]));
 	spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
 
-	return simple_read_from_buffer(user_buf, count, ppos, buf, res);
+	ret = simple_read_from_buffer(user_buf, count, ppos, buf, res);
+	kfree(buf);
+	return ret;
 }
 
 DEBUGFS_READONLY_FILE_OPS(queues);
-- 
2.50.1 (Apple Git-155)