mwifiex: printk() overflow with 32-byte SSIDs

commit fcd2042e8d36cf644bd2d69c26378d17158b17df upstream.

SSIDs aren't guaranteed to be 0-terminated. Let's cap the max length
when we print them out.

This can be easily noticed by connecting to a network with a 32-octet
SSID:

[ 3903.502925] mwifiex_pcie 0000:01:00.0: info: trying to associate to
'0123456789abcdef0123456789abcdef <uninitialized mem>' bssid
xx:xx:xx:xx:xx:xx

Fixes: 5e6e3a92b9a4 ("wireless: mwifiex: initial commit for Marvell mwifiex driver")
Signed-off-by: Brian Norris <briannorris@chromium.org>
Acked-by: Amitkumar Karwar <akarwar@marvell.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
[bwh: Backported to 3.2: adjust filename, context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>

diff --git a/drivers/net/wireless/mwifiex/cfg80211.c b/drivers/net/wireless/mwifiex/cfg80211.c
index 45ac407..4d7e334 100644 (file)
--- a/drivers/net/wireless/mwifiex/cfg80211.c
+++ b/drivers/net/wireless/mwifiex/cfg80211.c
@@ -944,8 +944,9 @@ done:
                        }
                        is_scanning_required = 1;
                } else {
-                       dev_dbg(priv->adapter->dev, "info: trying to associate to %s and bssid %pM\n",
-                                       (char *) req_ssid.ssid, bss->bssid);
+                       dev_dbg(priv->adapter->dev, "info: trying to associate to '%.*s' bssid %pM\n",
+                               req_ssid.ssid_len, (char *)req_ssid.ssid,
+                               bss->bssid);
                        memcpy(&priv->cfg_bssid, bss->bssid, ETH_ALEN);
                        break;
                }
@@ -989,8 +990,8 @@ mwifiex_cfg80211_connect(struct wiphy *wiphy, struct net_device *dev,
 
        priv->assoc_request = -EINPROGRESS;
 
-       wiphy_dbg(wiphy, "info: Trying to associate to %s and bssid %pM\n",
-              (char *) sme->ssid, sme->bssid);
+       wiphy_dbg(wiphy, "info: Trying to associate to %.*s and bssid %pM\n",
+                 (int)sme->ssid_len, (char *)sme->ssid, sme->bssid);
 
        ret = mwifiex_cfg80211_assoc(priv, sme->ssid_len, sme->ssid, sme->bssid,
                                     priv->bss_mode, sme->channel, sme, 0);
@@ -1026,8 +1027,8 @@ mwifiex_cfg80211_join_ibss(struct wiphy *wiphy, struct net_device *dev,
 
        priv->ibss_join_request = -EINPROGRESS;
 
-       wiphy_dbg(wiphy, "info: trying to join to %s and bssid %pM\n",
-              (char *) params->ssid, params->bssid);
+       wiphy_dbg(wiphy, "info: trying to join to %.*s and bssid %pM\n",
+                 params->ssid_len, (char *)params->ssid, params->bssid);
 
        ret = mwifiex_cfg80211_assoc(priv, params->ssid_len, params->ssid,
                                params->bssid, priv->bss_mode,