Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit a497e47d authored by Dan Carpenter's avatar Dan Carpenter Committed by John W. Linville
Browse files

libertas: potential oops in debugfs 



If we do a zero size allocation then it will oops.  Also we can't be
sure the user passes us a NUL terminated string so I've added a
terminator.

This code can only be triggered by root.

Reported-by: default avatarNico Golde <nico@ngolde.de>
Reported-by: default avatarFabian Yamaguchi <fabs@goesec.de>
Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Acked-by: default avatarDan Williams <dcbw@redhat.com>
Signed-off-by: default avatarJohn W. Linville <linville@tuxdriver.com>
parent 450991fd

drivers/net/wireless/libertas/debugfs.c

+5 −1
Original line number Diff line number Diff line
@@ -913,7 +913,10 @@ static ssize_t lbs_debugfs_write(struct file *f, const char __user *buf, 
	char *p2;

	struct debug_data *d = f->private_data;



	pdata = kmalloc(cnt, GFP_KERNEL);

	if (cnt == 0)

		return 0;



	pdata = kmalloc(cnt + 1, GFP_KERNEL);

	if (pdata == NULL)

		return 0;
@@ -922,6 +925,7 @@ static ssize_t lbs_debugfs_write(struct file *f, const char __user *buf, 
		kfree(pdata);

		return 0;

	}

	pdata[cnt] = '\0';



	p0 = pdata;

	for (i = 0; i < num_of_items; i++) {