diff options
| author | Rafał Miłecki <rafal@milecki.pl> | 2018-05-08 12:31:04 +0300 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2018-05-30 09:17:17 +0300 |
| commit | b0ea08e1bd67af984e4de51f05c973528cd0f7fb (patch) | |
| tree | 2d1707dac21cbba47fab92ba23d4d98c1856b04f | |
| parent | 98d02fd4618c48d75589820e8fc39e60c3d3728e (diff) | |
| download | linux-b0ea08e1bd67af984e4de51f05c973528cd0f7fb.tar.xz | |
bcma: fix buffer size caused crash in bcma_core_mips_print_irq()
commit 361de091a4b97aa9081d304d742f80d486ab7125 upstream.
Used buffer wasn't big enough to hold whole strings. Example output of
this function is:
[ 0.180892] bcma: bus0: core 0x0800, irq: 2(S)* 3 4 5 6 D I
[ 0.180948] bcma: bus0: core 0x0812, irq: 2(S) 3* 4 5 6 D I
[ 0.180998] bcma: bus0: core 0x082d, irq: 2(S) 3 4* 5 6 D I
[ 0.181046] bcma: bus0: core 0x082c, irq: 2(S) 3 4 5 6 D I*
which means we need to store up to 24 chars.
Fixes: 758f7e06063a8 ("bcma: Use bcma_debug and not pr_cont in MIPS driver")
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
Cc: stable@vger.kernel.org # v4.15+
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| -rw-r--r-- | drivers/bcma/driver_mips.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/bcma/driver_mips.c b/drivers/bcma/driver_mips.c index f040aba48d50..27e9686b6d3a 100644 --- a/drivers/bcma/driver_mips.c +++ b/drivers/bcma/driver_mips.c @@ -184,7 +184,7 @@ static void bcma_core_mips_print_irq(struct bcma_device *dev, unsigned int irq) { int i; static const char *irq_name[] = {"2(S)", "3", "4", "5", "6", "D", "I"}; - char interrupts[20]; + char interrupts[25]; char *ints = interrupts; for (i = 0; i < ARRAY_SIZE(irq_name); i++) |