queues_read() formats all queue state lines into a fixed stack buffer
that budgets only 20 bytes per queue and appends each line with
sprintf().

The queue-stop reason bitmap is printed with %#.8lx, whose width is not
capped on 64-bit builds, and the pending queue length field can add more
digits still. The cumulative output can therefore run past the end of
the fixed stack buffer.

Format the output into a PAGE_SIZE heap buffer with scnprintf() and stop
once the debugfs read buffer is full.

Fixes: db2e6bd4e966 ("mac80211: add queue debugfs file")

Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
---
 net/mac80211/debugfs.c | 22 +++++++++++++++-------
 1 file changed, 15 insertions(+), 7 deletions(-)

diff --git a/net/mac80211/debugfs.c b/net/mac80211/debugfs.c
index 5a1831b08677..2cf6342d28db 100644
--- a/net/mac80211/debugfs.c
+++ b/net/mac80211/debugfs.c
@@ -9,6 +9,7 @@
 
 #include <linux/debugfs.h>
 #include <linux/rtnetlink.h>
+#include <linux/slab.h>
 #include <linux/vmalloc.h>
 #include "ieee80211_i.h"
 #include "driver-ops.h"
@@ -596,17 +597,24 @@ static ssize_t queues_read(struct file *file, char __user *user_buf,
 {
 	struct ieee80211_local *local = file->private_data;
 	unsigned long flags;
-	char buf[IEEE80211_MAX_QUEUES * 20];
-	int q, res = 0;
+	char *buf;
+	int q, res = 0, ret;
+
+	buf = kmalloc(PAGE_SIZE, GFP_KERNEL);
+	if (!buf)
+		return -ENOMEM;
 
 	spin_lock_irqsave(&local->queue_stop_reason_lock, flags);
-	for (q = 0; q < local->hw.queues; q++)
-		res += sprintf(buf + res, "%02d: %#.8lx/%d\n", q,
-				local->queue_stop_reasons[q],
-				skb_queue_len(&local->pending[q]));
+	for (q = 0; q < local->hw.queues && res < PAGE_SIZE; q++)
+		res += scnprintf(buf + res, PAGE_SIZE - res,
+				 "%02d: %#.8lx/%d\n", q,
+				 local->queue_stop_reasons[q],
+				 skb_queue_len(&local->pending[q]));
 	spin_unlock_irqrestore(&local->queue_stop_reason_lock, flags);
 
-	return simple_read_from_buffer(user_buf, count, ppos, buf, res);
+	ret = simple_read_from_buffer(user_buf, count, ppos, buf, res);
+	kfree(buf);
+	return ret;
 }
 
 DEBUGFS_READONLY_FILE_OPS(queues);
-- 
2.50.1 (Apple Git-155)

Hi Johannes,

Thanks for reviewing it.

I rechecked the bounds and agree that the overflow claim is not
established for the current code. I'll drop this patch.

Thanks,
Pengpeng

On Fri, 2026-04-17 at 15:46 +0800, Pengpeng Hou wrote:
> queues_read() formats all queue state lines into a fixed stack buffer
> that budgets only 20 bytes per queue and appends each line with
> sprintf().
> 
> The queue-stop reason bitmap is printed with %#.8lx, whose width is not
> capped on 64-bit builds, and the pending queue length field can add more
> digits still. The cumulative output can therefore run past the end of
> the fixed stack buffer.

I'd agree the code isn't optimal, but this simply isn't true.

> Format the output into a PAGE_SIZE heap buffer with scnprintf() and stop
> once the debugfs read buffer is full.

And the fix is just strange.

> Fixes: db2e6bd4e966 ("mac80211: add queue debugfs file")
> 
> Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>

There also should be no blank line there.

johannes