[PATCH] staging: r8821ae: avoid leaking format string

[PATCH] staging: r8821ae: avoid leaking format string

[Kees Cook]

This make sure a format string cannot leak into the work queue name nor
the printk buffer.

Signed-off-by: Kees Cook <keescook@chromium.org>
---
This is the third time this set of macros has entered the kernel:

drivers/net/wireless/rtlwifi/btcoexist/halbtcoutsrc.h
drivers/staging/rtl8192ee/btcoexist/halbtcoutsrc.h
drivers/staging/rtl8821ae/btcoexist/halbtcoutsrc.h

Can we extract these macros to some common place and keep them from returning?
---
 drivers/staging/rtl8821ae/btcoexist/halbtcoutsrc.h |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/staging/rtl8821ae/btcoexist/halbtcoutsrc.h b/drivers/staging/rtl8821ae/btcoexist/halbtcoutsrc.h
index 787798e76217..fd233cc85a5b 100644
--- a/drivers/staging/rtl8821ae/btcoexist/halbtcoutsrc.h
+++ b/drivers/staging/rtl8821ae/btcoexist/halbtcoutsrc.h
@@ -88,7 +88,7 @@ extern u32 btc_dbg_type[];
 
 
 #define	CL_SPRINTF	snprintf
-#define	CL_PRINTF	printk
+#define	CL_PRINTF(buf)	printk("%s", buf)
 
 #define	BTC_PRINT(dbgtype, dbgflag, printstr, ...)		\
 	do { 							\
-- 
1.7.9.5


-- 
Kees Cook
Chrome OS Security

Re: [PATCH] staging: r8821ae: avoid leaking format string

[Greg Kroah-Hartman]

On Thu, Jul 10, 2014 at 01:16:11PM -0700, Kees Cook wrote:
> This make sure a format string cannot leak into the work queue name nor
> the printk buffer.
> 
> Signed-off-by: Kees Cook <keescook@chromium.org>
> ---
> This is the third time this set of macros has entered the kernel:
> 
> drivers/net/wireless/rtlwifi/btcoexist/halbtcoutsrc.h
> drivers/staging/rtl8192ee/btcoexist/halbtcoutsrc.h
> drivers/staging/rtl8821ae/btcoexist/halbtcoutsrc.h
> 
> Can we extract these macros to some common place and keep them from returning?

I wish.  These are all from the same company.  Each new version of their
hardware consists of a whole dump of a wireless stack.  People are
working on addressing this issue, by writing "real" drivers for the
hardware, and working with the company to not keep doing this.  But odds
are, I'll get a new driver for the next chip from them that does the
same thing :(

thanks for the patch, I'll queue it up.

greg k-h