From patchwork Wed Apr 21 13:14:40 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Dan Carpenter X-Patchwork-Id: 425714 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-15.8 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_CR_TRAILER, INCLUDES_PATCH, MAILING_LIST_MULTI, SPF_HELO_NONE, SPF_PASS, UNPARSEABLE_RELAY autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 765BBC433B4 for ; Wed, 21 Apr 2021 13:27:18 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id EFAAB6144B for ; Wed, 21 Apr 2021 13:27:17 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S241443AbhDUN1u (ORCPT ); Wed, 21 Apr 2021 09:27:50 -0400 Received: from mx0b-00069f02.pphosted.com ([205.220.177.32]:54476 "EHLO mx0b-00069f02.pphosted.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S238455AbhDUN1t (ORCPT ); Wed, 21 Apr 2021 09:27:49 -0400 Received: from pps.filterd (m0246632.ppops.net [127.0.0.1]) by mx0b-00069f02.pphosted.com (8.16.0.43/8.16.0.43) with SMTP id 13LDCEw9005847; Wed, 21 Apr 2021 13:15:03 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.com; h=date : from : to : cc : subject : message-id : mime-version : content-type; s=corp-2020-01-29; bh=FlzphcOCSgX+2k3rUk5ygmbE2dHWikxsYFYPqUAoI5A=; b=vDAk9jhA93QJm/tDNOkTo9apIGr5dShybhB+BrCKFXqBJL86F6Gl+N9stG+JyVEMDCOi sKmqXkx9QnkYcWXMLJ/5sBCOCoOU6FVdx8tKPOUuXDH1M/vnd/S4r3NmRIexi6SVpqwL XYbwAucWPfh66eyIPDbZz//gmFF6pJdVIoYWBiToKA4IleZ+tthQwPDOStg6pGgJ75Mg E2eA6tCy010xvN3MwyvfZ7nFXPtEtgL+Bd+SmKGD9mPx1wUdfkf6oejeBODEbYU/4tOB +hWTurCU2xa6xeDdRachcbvTmWhU5r+h5Ll03v8SlyCU/NSXaTjO9/dq68lqd5Pb83nK gw== Received: from oracle.com (aserp3030.oracle.com [141.146.126.71]) by mx0b-00069f02.pphosted.com with ESMTP id 381bjn8pra-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 21 Apr 2021 13:15:02 +0000 Received: from aserp3030.oracle.com (aserp3030.oracle.com [127.0.0.1]) by pps.podrdrct (8.16.0.36/8.16.0.36) with SMTP id 13LDF26f098309; Wed, 21 Apr 2021 13:15:02 GMT Received: from pps.reinject (localhost [127.0.0.1]) by aserp3030.oracle.com with ESMTP id 38098rqhhq-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 21 Apr 2021 13:15:02 +0000 Received: from aserp3030.oracle.com (aserp3030.oracle.com [127.0.0.1]) by pps.reinject (8.16.0.36/8.16.0.36) with SMTP id 13LDF1uk098159; Wed, 21 Apr 2021 13:15:01 GMT Received: from userv0121.oracle.com (userv0121.oracle.com [156.151.31.72]) by aserp3030.oracle.com with ESMTP id 38098rqhdt-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 21 Apr 2021 13:15:01 +0000 Received: from abhmp0011.oracle.com (abhmp0011.oracle.com [141.146.116.17]) by userv0121.oracle.com (8.14.4/8.13.8) with ESMTP id 13LDEqlP015391; Wed, 21 Apr 2021 13:14:52 GMT Received: from mwanda (/102.36.221.92) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Wed, 21 Apr 2021 06:14:52 -0700 Date: Wed, 21 Apr 2021 16:14:40 +0300 From: Dan Carpenter To: Felix Fietkau Cc: Lorenzo Bianconi , Ryder Lee , Kalle Valo , Matthias Brugger , Sean Wang , Soul Huang , linux-wireless@vger.kernel.org, linux-mediatek@lists.infradead.org, kernel-janitors@vger.kernel.org Subject: [PATCH 1/3] mt76: mt7615: fix a precision vs width bug in printk Message-ID: MIME-Version: 1.0 Content-Disposition: inline X-Mailer: git-send-email haha only kidding X-Proofpoint-GUID: IN-xhjViv_z8hvaYiIkNq2YIg1Cs348v X-Proofpoint-ORIG-GUID: IN-xhjViv_z8hvaYiIkNq2YIg1Cs348v Precedence: bulk List-ID: X-Mailing-List: linux-wireless@vger.kernel.org Precision "%.*s" was intended instead of width "%*s". The original code will print garbage from beyond the end of the skb->data. Fixes: d76d6c3ba2b0 ("mt76: mt7615: limit firmware log message printk to buffer length") Signed-off-by: Dan Carpenter --- drivers/net/wireless/mediatek/mt76/mt7615/mcu.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/wireless/mediatek/mt76/mt7615/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7615/mcu.c index 9b9f8d88e9bb..00b1b657cb21 100644 --- a/drivers/net/wireless/mediatek/mt76/mt7615/mcu.c +++ b/drivers/net/wireless/mediatek/mt76/mt7615/mcu.c @@ -424,7 +424,7 @@ mt7615_mcu_rx_log_message(struct mt7615_dev *dev, struct sk_buff *skb) break; } - wiphy_info(mt76_hw(dev)->wiphy, "%s: %*s", type, + wiphy_info(mt76_hw(dev)->wiphy, "%s: %.*s", type, (int)(skb->len - sizeof(*rxd)), data); } From patchwork Wed Apr 21 13:15:14 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Dan Carpenter X-Patchwork-Id: 426158 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-15.8 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_CR_TRAILER, INCLUDES_PATCH, MAILING_LIST_MULTI, SPF_HELO_NONE, SPF_PASS, UNPARSEABLE_RELAY autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 8D7B1C43461 for ; Wed, 21 Apr 2021 13:26:45 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 5E8DF601FD for ; Wed, 21 Apr 2021 13:26:45 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S240753AbhDUN1Q (ORCPT ); Wed, 21 Apr 2021 09:27:16 -0400 Received: from mx0b-00069f02.pphosted.com ([205.220.177.32]:15454 "EHLO mx0b-00069f02.pphosted.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S239158AbhDUN1P (ORCPT ); Wed, 21 Apr 2021 09:27:15 -0400 X-Greylist: delayed 684 seconds by postgrey-1.27 at vger.kernel.org; Wed, 21 Apr 2021 09:27:15 EDT Received: from pps.filterd (m0246630.ppops.net [127.0.0.1]) by mx0b-00069f02.pphosted.com (8.16.0.43/8.16.0.43) with SMTP id 13LDDZDL017595; Wed, 21 Apr 2021 13:15:26 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.com; h=date : from : to : cc : subject : message-id : mime-version : content-type : in-reply-to; s=corp-2020-01-29; bh=voSpbjx/x56pXz5sZw/CvfaDp0mSkH/RSK4TECgB8kk=; b=LzC4TYjngueQCSNQfKQi2Qd94J8kyx4A6a3haihNzDz5SJ0ZUyLL2UyrwruK1AIC4LO9 0BL2f7m8v050YsJz54oZ6U2rVGY52c+SHIWbgyuDQnmHyPt5ztA1ISWXeTj1EQjwK7++ 41pbviWy4SHIILXCtXji1DrbH82qT0xL1xizbN5G4hmG1fvRiTIyHeCxTYSt4Y/hZyCw 6v8FEJq4qsocRz2xHNLhKpr4EatrYd9cy/R+2ikDMOeFFUKIQyo/gy8eYymVtIKYyUjH i3z8sL2R1BBCSEZZRl63KIfAVGEvsYUnhTiHkGR7XuU2Gj9fF6xJlL4KP/4+JpZxQuIr MA== Received: from oracle.com (aserp3030.oracle.com [141.146.126.71]) by mx0b-00069f02.pphosted.com with ESMTP id 3819340qkw-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 21 Apr 2021 13:15:26 +0000 Received: from aserp3030.oracle.com (aserp3030.oracle.com [127.0.0.1]) by pps.podrdrct (8.16.0.36/8.16.0.36) with SMTP id 13LDFMZi099267; Wed, 21 Apr 2021 13:15:25 GMT Received: from pps.reinject (localhost [127.0.0.1]) by aserp3030.oracle.com with ESMTP id 38098rqj3v-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 21 Apr 2021 13:15:25 +0000 Received: from aserp3030.oracle.com (aserp3030.oracle.com [127.0.0.1]) by pps.reinject (8.16.0.36/8.16.0.36) with SMTP id 13LDFOZk099410; Wed, 21 Apr 2021 13:15:24 GMT Received: from aserv0121.oracle.com (aserv0121.oracle.com [141.146.126.235]) by aserp3030.oracle.com with ESMTP id 38098rqj2w-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 21 Apr 2021 13:15:24 +0000 Received: from abhmp0005.oracle.com (abhmp0005.oracle.com [141.146.116.11]) by aserv0121.oracle.com (8.14.4/8.13.8) with ESMTP id 13LDFMOV023395; Wed, 21 Apr 2021 13:15:23 GMT Received: from mwanda (/102.36.221.92) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Wed, 21 Apr 2021 06:15:22 -0700 Date: Wed, 21 Apr 2021 16:15:14 +0300 From: Dan Carpenter To: Felix Fietkau Cc: Lorenzo Bianconi , Ryder Lee , Kalle Valo , Matthias Brugger , Shayne Chen , linux-wireless@vger.kernel.org, linux-mediatek@lists.infradead.org, kernel-janitors@vger.kernel.org Subject: [PATCH 2/3] mt76: mt7915: fix a precision vs width bug in printk Message-ID: MIME-Version: 1.0 Content-Disposition: inline In-Reply-To: X-Mailer: git-send-email haha only kidding X-Proofpoint-ORIG-GUID: _DsSEl4YivLeT4BCMHLoEUKFyR-Hx3Ze X-Proofpoint-GUID: _DsSEl4YivLeT4BCMHLoEUKFyR-Hx3Ze Precedence: bulk List-ID: X-Mailing-List: linux-wireless@vger.kernel.org Precision %.*s was intended instead of width %.*s. The original code will still print unintended data from beyond the end of skb->data. Fixes: 665b2c780d63 ("mt76: mt7915: limit firmware log message printk to buffer length") Signed-off-by: Dan Carpenter --- drivers/net/wireless/mediatek/mt76/mt7915/mcu.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c index 908e74a6b8e6..94195a1ad3b8 100644 --- a/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c +++ b/drivers/net/wireless/mediatek/mt76/mt7915/mcu.c @@ -521,7 +521,7 @@ mt7915_mcu_rx_log_message(struct mt7915_dev *dev, struct sk_buff *skb) break; } - wiphy_info(mt76_hw(dev)->wiphy, "%s: %*s", type, + wiphy_info(mt76_hw(dev)->wiphy, "%s: %.*s", type, (int)(skb->len - sizeof(*rxd)), data); } From patchwork Wed Apr 21 13:16:06 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Dan Carpenter X-Patchwork-Id: 425713 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-15.8 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_CR_TRAILER, INCLUDES_PATCH, MAILING_LIST_MULTI, SPF_HELO_NONE, SPF_PASS, UNPARSEABLE_RELAY autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 3FD1FC433ED for ; Wed, 21 Apr 2021 13:31:00 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 0F3F76008E for ; Wed, 21 Apr 2021 13:31:00 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S242128AbhDUNbc (ORCPT ); Wed, 21 Apr 2021 09:31:32 -0400 Received: from mx0a-00069f02.pphosted.com ([205.220.165.32]:38590 "EHLO mx0a-00069f02.pphosted.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S241644AbhDUNbb (ORCPT ); Wed, 21 Apr 2021 09:31:31 -0400 X-Greylist: delayed 867 seconds by postgrey-1.27 at vger.kernel.org; Wed, 21 Apr 2021 09:31:31 EDT Received: from pps.filterd (m0246617.ppops.net [127.0.0.1]) by mx0b-00069f02.pphosted.com (8.16.0.43/8.16.0.43) with SMTP id 13LDGLgx028054; Wed, 21 Apr 2021 13:16:21 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oracle.com; h=date : from : to : cc : subject : message-id : mime-version : content-type : in-reply-to; s=corp-2020-01-29; bh=lvHlrK+MD4CobteVF1oYxOoc1hik2TwFpy2Fj01dlKk=; b=fhh4VScIPfIZEwLTHciJt04EY0Y68kttQmtAOCIA+9C7xW+xv3U7nkn46XBvzZ3RaBer UDdQEsGzDRSGsdEIiKfYUGXsxKLiXUcc/DsIckoe/9pz09SOlL8pnd8BlQ4VaHswvQVz ERhG84v+L1zs8+sejxc6EorE0XVkkHLBSF7/NqtS/6U961mUfkDHzNVAnu0zFer20UFQ KUbB+uW20uv+pBwvm8VLw9GCE+YdO2yiqCp9zbWXVNY681pH2aii1cIYqU+BnZkTvff9 4ldeqOx0ZTxNSnD501zBgTdU11nc6ZKI4KY1XYk1/P0OtYoB+iheKK3NRzwCOS2POKLB bA== Received: from oracle.com (userp3030.oracle.com [156.151.31.80]) by mx0b-00069f02.pphosted.com with ESMTP id 381dum8p13-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 21 Apr 2021 13:16:20 +0000 Received: from userp3030.oracle.com (userp3030.oracle.com [127.0.0.1]) by pps.podrdrct (8.16.0.36/8.16.0.36) with SMTP id 13LDFsu1132150; Wed, 21 Apr 2021 13:16:19 GMT Received: from pps.reinject (localhost [127.0.0.1]) by userp3030.oracle.com with ESMTP id 3809m0kkev-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 21 Apr 2021 13:16:19 +0000 Received: from userp3030.oracle.com (userp3030.oracle.com [127.0.0.1]) by pps.reinject (8.16.0.36/8.16.0.36) with SMTP id 13LDGICW133342; Wed, 21 Apr 2021 13:16:18 GMT Received: from userv0121.oracle.com (userv0121.oracle.com [156.151.31.72]) by userp3030.oracle.com with ESMTP id 3809m0kkej-1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=OK); Wed, 21 Apr 2021 13:16:18 +0000 Received: from abhmp0006.oracle.com (abhmp0006.oracle.com [141.146.116.12]) by userv0121.oracle.com (8.14.4/8.13.8) with ESMTP id 13LDGH0H016345; Wed, 21 Apr 2021 13:16:17 GMT Received: from mwanda (/102.36.221.92) by default (Oracle Beehive Gateway v4.0) with ESMTP ; Wed, 21 Apr 2021 06:16:16 -0700 Date: Wed, 21 Apr 2021 16:16:06 +0300 From: Dan Carpenter To: Felix Fietkau , Lorenzo Bianconi Cc: Ryder Lee , Kalle Valo , Matthias Brugger , Sean Wang , Soul Huang , linux-wireless@vger.kernel.org, linux-mediatek@lists.infradead.org, kernel-janitors@vger.kernel.org Subject: [PATCH 3/3] mt76: mt7921: fix a precision vs width bug in printk Message-ID: MIME-Version: 1.0 Content-Disposition: inline In-Reply-To: X-Mailer: git-send-email haha only kidding X-Proofpoint-ORIG-GUID: j18SJFENXvV2rrmHVmlUHHQO5zv-r5Dv X-Proofpoint-GUID: j18SJFENXvV2rrmHVmlUHHQO5zv-r5Dv Precedence: bulk List-ID: X-Mailing-List: linux-wireless@vger.kernel.org Precision %.*s was intended instead of width %*s. The original code is potentially an information leak. Fixes: c7cc5ec57303 ("mt76: mt7921: rework mt7921_mcu_debug_msg_event routine") Signed-off-by: Dan Carpenter --- drivers/net/wireless/mediatek/mt76/mt7921/mcu.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/mcu.c b/drivers/net/wireless/mediatek/mt76/mt7921/mcu.c index aa55667b6ed7..45ad2c337d41 100644 --- a/drivers/net/wireless/mediatek/mt76/mt7921/mcu.c +++ b/drivers/net/wireless/mediatek/mt76/mt7921/mcu.c @@ -500,7 +500,7 @@ mt7921_mcu_debug_msg_event(struct mt7921_dev *dev, struct sk_buff *skb) if (!msg->content[i]) msg->content[i] = ' '; } - wiphy_info(mt76_hw(dev)->wiphy, "%*s", len, msg->content); + wiphy_info(mt76_hw(dev)->wiphy, "%.*s", len, msg->content); } }