android/android_kernel_asus_sm8350
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ipw2200: prevent alloc of unspecified size on stack

Browse Source 
if log_len is larger than 4K then we are killing the stack.
allocate on heap instead and limit size to what practically can
be used (PAGE_SIZE)

Signed-off-by: Reinette Chatre <reinette.chatre@intel.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
This commit is contained in:
Reinette Chatre
2007-12-18 22:01:02 -08:00
committed by John W. Linville
parent b24d22b1d1
commit 412e9e7800
1 changed files with 12 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
drivers/net/wireless/ipw2200.c
View File

@ -1233,9 +1233,19 @@ static ssize_t show_event_log(struct device *d,
{ {
struct ipw_priv *priv = dev_get_drvdata(d); struct ipw_priv *priv = dev_get_drvdata(d);
u32 log_len = ipw_get_event_log_len(priv); u32 log_len = ipw_get_event_log_len(priv);
struct ipw_event log[log_len]; u32 log_size;
struct ipw_event *log;
u32 len = 0, i; u32 len = 0, i;
/* not using min() because of its strict type checking */
log_size = PAGE_SIZE / sizeof(*log) > log_len ?
sizeof(*log) * log_len : PAGE_SIZE;
log = kzalloc(log_size, GFP_KERNEL);
if (!log) {
IPW_ERROR("Unable to allocate memory for log\n");
return 0;
}
log_len = log_size / sizeof(*log);
ipw_capture_event_log(priv, log_len, log); ipw_capture_event_log(priv, log_len, log);
len += snprintf(buf + len, PAGE_SIZE - len, "%08X", log_len); len += snprintf(buf + len, PAGE_SIZE - len, "%08X", log_len);
@ -1244,6 +1254,7 @@ static ssize_t show_event_log(struct device *d,
"\n%08X%08X%08X", "\n%08X%08X%08X",
log[i].time, log[i].event, log[i].data); log[i].time, log[i].event, log[i].data);
len += snprintf(buf + len, PAGE_SIZE - len, "\n"); len += snprintf(buf + len, PAGE_SIZE - len, "\n");
kfree(log);
return len; return len;
} }