wlcore: Fix buffer overrun by snprintf due to incorrect buffer size
authorColin Ian King <colin.king@canonical.com>
Mon, 19 Apr 2021 14:14:05 +0000 (15:14 +0100)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Fri, 14 May 2021 07:50:42 +0000 (09:50 +0200)
commitb6b894e7a27e52a9032a7eaace538538830d4b9e
tree4f7265d5e6153f6b0dd022496ff53661d2385428
parent1cce33fe59f095c6198de32e5fcda36e703dfddb
wlcore: Fix buffer overrun by snprintf due to incorrect buffer size

[ Upstream commit a9a4c080deb33f44e08afe35f4ca4bb9ece89f4e ]

The size of the buffer than can be written to is currently incorrect, it is
always the size of the entire buffer even though the snprintf is writing
as position pos into the buffer. Fix this by setting the buffer size to be
the number of bytes left in the buffer, namely sizeof(buf) - pos.

Addresses-Coverity: ("Out-of-bounds access")
Fixes: 7b0e2c4f6be3 ("wlcore: fix overlapping snprintf arguments in debugfs")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Reviewed-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20210419141405.180582-1-colin.king@canonical.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
drivers/net/wireless/ti/wlcore/debugfs.h