From bacb646f404d04ad7c00c35f10d77d23ea6bc8b2 Mon Sep 17 00:00:00 2001 From: Ashish Kumar Dhanotiya Date: Mon, 14 Jun 2021 14:29:50 +0530 Subject: [PATCH] qcacld-3.0: Avoid buffer overflow in llstats debugfs response Currently driver does not subtract the already filled length from the max available length when it copies the number of radios to the llstats result buffer which may lead to buffer overflow. To address this issue subtract already filled length from the max available length when driver copies the number of radios. Change-Id: Ie3b93121df603bd65250f0b0a49bb049d353211d CRs-Fixed: 2969637 --- core/hdd/src/wlan_hdd_debugfs_llstat.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/core/hdd/src/wlan_hdd_debugfs_llstat.c b/core/hdd/src/wlan_hdd_debugfs_llstat.c index 54cc13fa391c..6b8e4fc2a113 100644 --- a/core/hdd/src/wlan_hdd_debugfs_llstat.c +++ b/core/hdd/src/wlan_hdd_debugfs_llstat.c @@ -236,8 +236,8 @@ void hdd_debugfs_process_radio_stats(struct hdd_adapter *adapter, buffer = ll_stats.result; buffer += ll_stats.len; - len = scnprintf(buffer, DEBUGFS_LLSTATS_BUF_SIZE, - "\n\n===LL_STATS_RADIO: number of radios: %u===", + len = scnprintf(buffer, DEBUGFS_LLSTATS_BUF_SIZE - ll_stats.len, + "\n\n===LL_STATS_RADIO: number of radios: %u===", num_radio); for (i = 0; i < num_radio; i++) {