| From 333fde48cc2388b4fd97259cac0d976f55730f5b Mon Sep 17 00:00:00 2001 |
| From: Sasha Levin <sashal@kernel.org> |
| Date: Wed, 22 Aug 2018 15:22:15 +0200 |
| Subject: brcmfmac: fix wrong strnchr usage |
| |
| From: Rasmus Villemoes <linux@rasmusvillemoes.dk> |
| |
| [ Upstream commit cb18e2e9ec71d42409a51b83546686c609780dde ] |
| |
| strnchr takes arguments in the order of its name: string, max bytes to |
| read, character to search for. Here we're passing '\n' aka 10 as the |
| buffer size, and searching for sizeof(buf) aka BRCMF_DCMD_SMLEN aka |
| 256 (aka '\0', since it's implicitly converted to char) within those 10 |
| bytes. |
| |
| Just interchanging the last two arguments would still leave a bug, |
| because if we've been successful once, there are not sizeof(buf) |
| characters left after the new value of p. |
| |
| Since clmver is immediately afterwards passed as a %s argument, I assume |
| that it is actually a properly nul-terminated string. For that case, we |
| have strreplace(). |
| |
| Signed-off-by: Rasmus Villemoes <linux@rasmusvillemoes.dk> |
| Signed-off-by: Kalle Valo <kvalo@codeaurora.org> |
| Signed-off-by: Sasha Levin <sashal@kernel.org> |
| --- |
| drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c | 4 +--- |
| 1 file changed, 1 insertion(+), 3 deletions(-) |
| |
| diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c |
| index 27893af63ebc3..8510d207ee87d 100644 |
| --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c |
| +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.c |
| @@ -296,9 +296,7 @@ int brcmf_c_preinit_dcmds(struct brcmf_if *ifp) |
| /* Replace all newline/linefeed characters with space |
| * character |
| */ |
| - ptr = clmver; |
| - while ((ptr = strnchr(ptr, '\n', sizeof(buf))) != NULL) |
| - *ptr = ' '; |
| + strreplace(clmver, '\n', ' '); |
| |
| brcmf_dbg(INFO, "CLM version = %s\n", clmver); |
| } |
| -- |
| 2.20.1 |
| |