mirror of
https://github.com/edk2-porting/linux-next.git
synced 2024-12-23 12:43:55 +08:00
ipw2200: prevent alloc of unspecified size on stack
if log_len is larger than 4K then we are killing the stack. allocate on heap instead and limit size to what practically can be used (PAGE_SIZE) Signed-off-by: Reinette Chatre <reinette.chatre@intel.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
This commit is contained in:
parent
b24d22b1d1
commit
412e9e7800
@ -1233,9 +1233,19 @@ static ssize_t show_event_log(struct device *d,
|
||||
{
|
||||
struct ipw_priv *priv = dev_get_drvdata(d);
|
||||
u32 log_len = ipw_get_event_log_len(priv);
|
||||
struct ipw_event log[log_len];
|
||||
u32 log_size;
|
||||
struct ipw_event *log;
|
||||
u32 len = 0, i;
|
||||
|
||||
/* not using min() because of its strict type checking */
|
||||
log_size = PAGE_SIZE / sizeof(*log) > log_len ?
|
||||
sizeof(*log) * log_len : PAGE_SIZE;
|
||||
log = kzalloc(log_size, GFP_KERNEL);
|
||||
if (!log) {
|
||||
IPW_ERROR("Unable to allocate memory for log\n");
|
||||
return 0;
|
||||
}
|
||||
log_len = log_size / sizeof(*log);
|
||||
ipw_capture_event_log(priv, log_len, log);
|
||||
|
||||
len += snprintf(buf + len, PAGE_SIZE - len, "%08X", log_len);
|
||||
@ -1244,6 +1254,7 @@ static ssize_t show_event_log(struct device *d,
|
||||
"\n%08X%08X%08X",
|
||||
log[i].time, log[i].event, log[i].data);
|
||||
len += snprintf(buf + len, PAGE_SIZE - len, "\n");
|
||||
kfree(log);
|
||||
return len;
|
||||
}
|
||||
|
||||
|
Loading…
Reference in New Issue
Block a user