cfg80211: off by one in ieee80211_bss()
authorDan Carpenter <dan.carpenter@oracle.com>
Thu, 24 Jan 2013 06:40:00 +0000 (09:40 +0300)
committerJohannes Berg <johannes.berg@intel.com>
Thu, 24 Jan 2013 14:47:22 +0000 (15:47 +0100)
We do a:

sprintf(buf, " Last beacon: %ums ago",
elapsed_jiffies_msecs(bss->ts));

elapsed_jiffies_msecs() can return a 10 digit number so "buf" needs to
be 31 characters long.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
net/wireless/scan.c

index 01592d7..45f1618 100644 (file)
@@ -1358,7 +1358,7 @@ ieee80211_bss(struct wiphy *wiphy, struct iw_request_info *info,
                                                  &iwe, IW_EV_UINT_LEN);
        }
 
-       buf = kmalloc(30, GFP_ATOMIC);
+       buf = kmalloc(31, GFP_ATOMIC);
        if (buf) {
                memset(&iwe, 0, sizeof(iwe));
                iwe.cmd = IWEVCUSTOM;