Search Linux Wireless

Re: [stable] [PATCH] mac80211: avoid possible buffer overrun in sta_agg_status_write

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



John, the patch below seems to have David Miller's ack that he applied
it to a tree back in November, but I don't see it in Linus's tree
anywhere.  Did something happen to it?

confused,

greg k-h

On Fri, Nov 07, 2008 at 03:26:59PM -0500, John W. Linville wrote:
> This addresses the bug report here:
> 
> 	http://bugzilla.kernel.org/show_bug.cgi?id=11975
> 
> Reported-by: Daniel Marjamäki <danielm77@xxxxxxxx>
> Cc: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx>
> Cc: Johannes Berg <johannes@xxxxxxxxxxxxxxxx>
> Cc: stable@xxxxxxxxxx
> Signed-off-by: John W. Linville <linville@xxxxxxxxxxxxx>
> ---
>  net/mac80211/debugfs_sta.c |    9 ++-------
>  1 files changed, 2 insertions(+), 7 deletions(-)
> 
> diff --git a/net/mac80211/debugfs_sta.c b/net/mac80211/debugfs_sta.c
> index 189d0ba..2e6752a 100644
> --- a/net/mac80211/debugfs_sta.c
> +++ b/net/mac80211/debugfs_sta.c
> @@ -184,7 +184,6 @@ static ssize_t sta_agg_status_write(struct file *file,
>  	char buf[32];
>  	int buf_size, rs;
>  	unsigned int tid_num;
> -	char state[4];
>  
>  	memset(buf, 0x00, sizeof(buf));
>  	buf_size = min(count, (sizeof(buf)-1));
> @@ -199,35 +198,31 @@ static ssize_t sta_agg_status_write(struct file *file,
>  		/* toggle Rx aggregation command */
>  		tid_num = tid_num - 100;
>  		if (tid_static_rx[tid_num] == 1) {
> -			strcpy(state, "off ");
>  			ieee80211_sta_stop_rx_ba_session(sta->sdata, da, tid_num, 0,
>  					WLAN_REASON_QSTA_REQUIRE_SETUP);
>  			sta->ampdu_mlme.tid_state_rx[tid_num] |=
>  					HT_AGG_STATE_DEBUGFS_CTL;
>  			tid_static_rx[tid_num] = 0;
>  		} else {
> -			strcpy(state, "on ");
>  			sta->ampdu_mlme.tid_state_rx[tid_num] &=
>  					~HT_AGG_STATE_DEBUGFS_CTL;
>  			tid_static_rx[tid_num] = 1;
>  		}
>  		printk(KERN_DEBUG "debugfs - try switching tid %u %s\n",
> -				tid_num, state);
> +				tid_num, tid_static_rx[tid_num] ? "on" : "off");
>  	} else if ((tid_num >= 0) && (tid_num <= 15)) {
>  		/* toggle Tx aggregation command */
>  		if (tid_static_tx[tid_num] == 0) {
> -			strcpy(state, "on ");
>  			rs =  ieee80211_start_tx_ba_session(hw, da, tid_num);
>  			if (rs == 0)
>  				tid_static_tx[tid_num] = 1;
>  		} else {
> -			strcpy(state, "off");
>  			rs =  ieee80211_stop_tx_ba_session(hw, da, tid_num, 1);
>  			if (rs == 0)
>  				tid_static_tx[tid_num] = 0;
>  		}
>  		printk(KERN_DEBUG "debugfs - switching tid %u %s, return=%d\n",
> -				tid_num, state, rs);
> +				tid_num, tid_static_tx[tid_num] ? "on" : "off", rs);
>  	}
>  
>  	return count;
> -- 
> 1.5.4.3
> 
> _______________________________________________
> stable mailing list
> stable@xxxxxxxxxxxxxxxx
> http://linux.kernel.org/mailman/listinfo/stable
--
To unsubscribe from this list: send the line "unsubscribe linux-wireless" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html

[Index of Archives]     [Linux Host AP]     [ATH6KL]     [Linux Bluetooth]     [Linux Netdev]     [Kernel Newbies]     [Linux Kernel]     [IDE]     [Security]     [Git]     [Netfilter]     [Bugtraq]     [Yosemite News]     [MIPS Linux]     [ARM Linux]     [Linux Security]     [Linux RAID]     [Linux ATA RAID]     [Samba]     [Device Mapper]
  Powered by Linux