queues_read() formats all queue state lines into a fixed stack buffer that budgets only 20 bytes per queue and appends each line with sprintf(). The queue-stop reason bitmap is printed with %#.8lx, whose width is not capped on 64-bit builds, and the pending queue length field can add more digits still. The cumulative output can therefore run past the end of the fixed stack buffer. Format the output into a PAGE_SIZE heap buffer with scnprintf() and stop once the debugfs read buffer is full. Fixes: db2e6bd4e966 ("mac80211: add queue debugfs file") Signed-off-by: Pengpeng Hou --- net/mac80211/debugfs.c | 22 +++++++++++++++------- 1 file changed, 15 insertions(+), 7 deletions(-) diff --git a/net/mac80211/debugfs.c b/net/mac80211/debugfs.c index 5a1831b08677..2cf6342d28db 100644 --- a/net/mac80211/debugfs.c +++ b/net/mac80211/debugfs.c @@ -9,6 +9,7 @@ #include #include +#include #include #include "ieee80211_i.h" #include "driver-ops.h" @@ -596,17 +597,24 @@ static ssize_t queues_read(struct file *file, char __user *user_buf, { struct ieee80211_local *local = file->private_data; unsigned long flags; - char buf[IEEE80211_MAX_QUEUES * 20]; - int q, res = 0; + char *buf; + int q, res = 0, ret; + + buf = kmalloc(PAGE_SIZE, GFP_KERNEL); + if (!buf) + return -ENOMEM; spin_lock_irqsave(&local->queue_stop_reason_lock, flags); - for (q = 0; q < local->hw.queues; q++) - res += sprintf(buf + res, "%02d: %#.8lx/%d\n", q, - local->queue_stop_reasons[q], - skb_queue_len(&local->pending[q])); + for (q = 0; q < local->hw.queues && res < PAGE_SIZE; q++) + res += scnprintf(buf + res, PAGE_SIZE - res, + "%02d: %#.8lx/%d\n", q, + local->queue_stop_reasons[q], + skb_queue_len(&local->pending[q])); spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags); - return simple_read_from_buffer(user_buf, count, ppos, buf, res); + ret = simple_read_from_buffer(user_buf, count, ppos, buf, res); + kfree(buf); + return ret; } DEBUGFS_READONLY_FILE_OPS(queues); -- 2.50.1 (Apple Git-155)