[PATCH 2/3] wifi: ath12k: Reserve space for a string terminator

Dan Carpenter error27 at gmail.com
Sat Sep 26 05:33:50 PDT 2026


On Sat, Sep 26, 2026 at 08:12:49PM +0800, Jiale Yao wrote:
> ath12k_write_htt_stats_type() accepts count == size, which fills the
> zero-initialized buffer without a terminating NUL. sscanf() then reads
> beyond the buffer.
> 
> Reject input that leaves no room for the trailing NUL.
> 
> Fixes: 8c7a5031a6b0 ("wifi: ath12k: Fix buffer overflow in debugfs")
> Signed-off-by: Jiale Yao <yaojiale02 at 163.com>
> ---

Reviewed-by: Dan Carpenter <error27 at gmail.com>

regards,
dan carpenter




More information about the ath12k mailing list