diff options
| author | Srinivas Girigowda <sgirigow@codeaurora.org> | 2017-03-21 15:44:29 -0700 |
|---|---|---|
| committer | qcabuildsw <qcabuildsw@localhost> | 2017-03-24 19:07:24 -0700 |
| commit | 63fda7306a1f003e9d2a207b3670b484599d58e5 (patch) | |
| tree | 1adc03c5f1be69a68f2c1a9b79dad7c0247cd17b | |
| parent | 7c8d7b01c6c6cdcad6541a0a66034739357f1630 (diff) | |
qcacld-3.0: Fix user space accesses
This is a qcacld-2.0 to qcacld-3.0 propagation.
Don't access user space memory directly in
drv_cmd_get_ibss_peer_info_all.
Change-Id: I36a706e2e91d1ed2a43897ac2eef9d81b2de7335
CRs-Fixed: 2023413
| -rw-r--r-- | core/hdd/src/wlan_hdd_ioctl.c | 7 |
1 files changed, 4 insertions, 3 deletions
diff --git a/core/hdd/src/wlan_hdd_ioctl.c b/core/hdd/src/wlan_hdd_ioctl.c index 6add68d8b95d..2f6a9efb89da 100644 --- a/core/hdd/src/wlan_hdd_ioctl.c +++ b/core/hdd/src/wlan_hdd_ioctl.c @@ -5134,8 +5134,9 @@ static int drv_cmd_get_ibss_peer_info_all(hdd_adapter_t *adapter, goto exit; } - priv_data->buf[numOfBytestoPrint] = '\0'; - hdd_debug("%s", priv_data->buf); + /* This overwrites the last space, which we already copied */ + extra[numOfBytestoPrint - 1] = '\0'; + hdd_debug("%s", extra); if (length > numOfBytestoPrint) { if (copy_to_user @@ -5146,7 +5147,7 @@ static int drv_cmd_get_ibss_peer_info_all(hdd_adapter_t *adapter, ret = -EFAULT; goto exit; } - hdd_debug("%s", &priv_data->buf[numOfBytestoPrint]); + hdd_debug("%s", &extra[numOfBytestoPrint]); } /* Free temporary buffer */ |