Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 8aada63c authored by Djalal Harouni's avatar Djalal Harouni Committed by John W. Linville
Browse files

ath5k: debugfs: NULL-terminate strings 



Avoid processing garbage data by NULL terminating the strings.

Signed-off-by: default avatarDjalal Harouni <tixxdz@opendz.org>
Signed-off-by: default avatarJohn W. Linville <linville@tuxdriver.com>
parent b380a43b

drivers/net/wireless/ath/ath5k/debug.c

+18 −6
Original line number Diff line number Diff line
@@ -245,9 +245,11 @@ static ssize_t write_file_beacon(struct file *file, 
	struct ath5k_hw *ah = file->private_data;

	char buf[20];



	if (copy_from_user(buf, userbuf, min(count, sizeof(buf))))

	count = min_t(size_t, count, sizeof(buf) - 1);

	if (copy_from_user(buf, userbuf, count))

		return -EFAULT;



	buf[count] = '\0';

	if (strncmp(buf, "disable", 7) == 0) {

		AR5K_REG_DISABLE_BITS(ah, AR5K_BEACON, AR5K_BEACON_ENABLE);

		pr_info("debugfs disable beacons\n");
@@ -345,9 +347,11 @@ static ssize_t write_file_debug(struct file *file, 
	unsigned int i;

	char buf[20];



	if (copy_from_user(buf, userbuf, min(count, sizeof(buf))))

	count = min_t(size_t, count, sizeof(buf) - 1);

	if (copy_from_user(buf, userbuf, count))

		return -EFAULT;



	buf[count] = '\0';

	for (i = 0; i < ARRAY_SIZE(dbg_info); i++) {

		if (strncmp(buf, dbg_info[i].name,

					strlen(dbg_info[i].name)) == 0) {
@@ -448,9 +452,11 @@ static ssize_t write_file_antenna(struct file *file, 
	unsigned int i;

	char buf[20];



	if (copy_from_user(buf, userbuf, min(count, sizeof(buf))))

	count = min_t(size_t, count, sizeof(buf) - 1);

	if (copy_from_user(buf, userbuf, count))

		return -EFAULT;



	buf[count] = '\0';

	if (strncmp(buf, "diversity", 9) == 0) {

		ath5k_hw_set_antenna_mode(ah, AR5K_ANTMODE_DEFAULT);

		pr_info("debug: enable diversity\n");
@@ -619,9 +625,11 @@ static ssize_t write_file_frameerrors(struct file *file, 
	struct ath5k_statistics *st = &ah->stats;

	char buf[20];



	if (copy_from_user(buf, userbuf, min(count, sizeof(buf))))

	count = min_t(size_t, count, sizeof(buf) - 1);

	if (copy_from_user(buf, userbuf, count))

		return -EFAULT;



	buf[count] = '\0';

	if (strncmp(buf, "clear", 5) == 0) {

		st->rxerr_crc = 0;

		st->rxerr_phy = 0;
@@ -766,9 +774,11 @@ static ssize_t write_file_ani(struct file *file, 
	struct ath5k_hw *ah = file->private_data;

	char buf[20];



	if (copy_from_user(buf, userbuf, min(count, sizeof(buf))))

	count = min_t(size_t, count, sizeof(buf) - 1);

	if (copy_from_user(buf, userbuf, count))

		return -EFAULT;



	buf[count] = '\0';

	if (strncmp(buf, "sens-low", 8) == 0) {

		ath5k_ani_init(ah, ATH5K_ANI_MODE_MANUAL_HIGH);

	} else if (strncmp(buf, "sens-high", 9) == 0) {
@@ -862,9 +872,11 @@ static ssize_t write_file_queue(struct file *file, 
	struct ath5k_hw *ah = file->private_data;

	char buf[20];



	if (copy_from_user(buf, userbuf, min(count, sizeof(buf))))

	count = min_t(size_t, count, sizeof(buf) - 1);

	if (copy_from_user(buf, userbuf, count))

		return -EFAULT;



	buf[count] = '\0';

	if (strncmp(buf, "start", 5) == 0)

		ieee80211_wake_queues(ah->hw);

	else if (strncmp(buf, "stop", 4) == 0)