diff options
| author | Ashish Kumar Dhanotiya <adhanoti@codeaurora.org> | 2021-06-14 14:29:50 +0530 |
|---|---|---|
| committer | Hsiu Chang Chen <hsiuchangchen@google.com> | 2021-07-08 04:45:50 +0000 |
| commit | c9041ea243a7d6da38365c00e51bd1cf2f443732 (patch) | |
| tree | dc684fc93e98aff056c90a80c06310394e95c46c | |
| parent | d872041b6e4bace17f2b51ff5a5d636b125253a7 (diff) | |
| download | qcacld-c9041ea243a7d6da38365c00e51bd1cf2f443732.tar.gz | |
qcacld-3.0: Avoid buffer overflow in llstats debugfs response
Currently driver does not subtract the already filled length
from the max available length when it copies the number of
radios to the llstats result buffer which may lead to buffer
overflow.
To address this issue subtract already filled length from the
max available length when driver copies the number of radios.
Bug: 171315276
Bug: 189164671
Test: Regression test
Change-Id: Ie3b93121df603bd65250f0b0a49bb049d353211d
CRs-Fixed: 2969637
Signed-off-by: Hsiu-Chang Chen <hsiuchangchen@google.com>
| -rw-r--r-- | core/hdd/src/wlan_hdd_debugfs_llstat.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/core/hdd/src/wlan_hdd_debugfs_llstat.c b/core/hdd/src/wlan_hdd_debugfs_llstat.c index 2caf9d4a9f..06508ece0c 100644 --- a/core/hdd/src/wlan_hdd_debugfs_llstat.c +++ b/core/hdd/src/wlan_hdd_debugfs_llstat.c @@ -236,8 +236,8 @@ void hdd_debugfs_process_radio_stats(struct hdd_adapter *adapter, buffer = ll_stats.result; buffer += ll_stats.len; - len = scnprintf(buffer, DEBUGFS_LLSTATS_BUF_SIZE, - "\n\n===LL_STATS_RADIO: number of radios: %u===", + len = scnprintf(buffer, DEBUGFS_LLSTATS_BUF_SIZE - ll_stats.len, + "\n\n===LL_STATS_RADIO: number of radios: %u===", num_radio); for (i = 0; i < num_radio; i++) { |