Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 9746010b authored by Dan Carpenter's avatar Dan Carpenter Committed by John W. Linville
Browse files

ath9k: snprintf() returns largish values 



The snprintf() function returns the number of characters that would have
been written (not counting the NUL character on the end).  It could
potentially be larger than the size of the buffer.

Signed-off-by: default avatarDan Carpenter <error27@gmail.com>
Signed-off-by: default avatarJohn W. Linville <linville@tuxdriver.com>
parent 929ebd30

drivers/net/wireless/ath/ath9k/htc_drv_main.c

+9 −0
Original line number Diff line number Diff line
@@ -524,6 +524,9 @@ static ssize_t read_file_tgt_stats(struct file *file, char __user *user_buf, 
	len += snprintf(buf + len, sizeof(buf) - len,

			"%19s : %10u\n", "TX Rate", priv->debug.txrate);



	if (len > sizeof(buf))

		len = sizeof(buf);



	return simple_read_from_buffer(user_buf, count, ppos, buf, len);

}
@@ -569,6 +572,9 @@ static ssize_t read_file_xmit(struct file *file, char __user *user_buf, 
			"%20s : %10u\n", "VO queued",

			priv->debug.tx_stats.queue_stats[WME_AC_VO]);



	if (len > sizeof(buf))

		len = sizeof(buf);



	return simple_read_from_buffer(user_buf, count, ppos, buf, len);

}
@@ -595,6 +601,9 @@ static ssize_t read_file_recv(struct file *file, char __user *user_buf, 
			"%20s : %10u\n", "SKBs Dropped",

			priv->debug.rx_stats.skb_dropped);



	if (len > sizeof(buf))

		len = sizeof(buf);



	return simple_read_from_buffer(user_buf, count, ppos, buf, len);

}