3.16.65-rc1 review patch. If anyone has any objections, please let me know.
------------------ From: Dan Carpenter <[email protected]> commit 3d39e1bb1c88f32820c5f9271f2c8c2fb9a52bac upstream. It looks like we wanted to print a maximum of BSSList_rid.ssidLen bytes of the ssid, but we accidentally use "%*s" (width) instead of "%.*s" (precision) so if the ssid doesn't have a NUL terminator this could lead to an overflow. Static analysis. Not tested. Fixes: e174961ca1a0 ("net: convert print_mac to %pM") Signed-off-by: Dan Carpenter <[email protected]> Signed-off-by: Kalle Valo <[email protected]> [bwh: Backported to 3.16: adjust filename] Signed-off-by: Ben Hutchings <[email protected]> --- drivers/net/wireless/airo.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/drivers/net/wireless/airo.c +++ b/drivers/net/wireless/airo.c @@ -5469,7 +5469,7 @@ static int proc_BSSList_open( struct ino we have to add a spin lock... */ rc = readBSSListRid(ai, doLoseSync, &BSSList_rid); while(rc == 0 && BSSList_rid.index != cpu_to_le16(0xffff)) { - ptr += sprintf(ptr, "%pM %*s rssi = %d", + ptr += sprintf(ptr, "%pM %.*s rssi = %d", BSSList_rid.bssid, (int)BSSList_rid.ssidLen, BSSList_rid.ssid,
