2 files changed, 15 insertions, 10 deletions

diff --git a/net/mac80211/rc80211_minstrel_debugfs.c b/net/mac80211/rc80211_minstrel_debugfs.c
index edde723f9f00..2acab1bcaa4b 100644
--- a/net/mac80211/rc80211_minstrel_debugfs.c
+++ b/net/mac80211/rc80211_minstrel_debugfs.c
@@ -62,14 +62,14 @@ minstrel_stats_open(struct inode *inode, struct file *file)
         unsigned int i, tp, prob, eprob;
         char *p;
 
-        ms = kmalloc(sizeof(*ms) + 4096, GFP_KERNEL);
+        ms = kmalloc(2048, GFP_KERNEL);
         if (!ms)
                 return -ENOMEM;
 
         file->private_data = ms;
         p = ms->buf;
-        p += sprintf(p, "rate      throughput  ewma prob  this prob  "
-                        "this succ/attempt   success    attempts\n");
+        p += sprintf(p, "rate          tpt eprob *prob"
+                        "  *ok(*cum)        ok(      cum)\n");
         for (i = 0; i < mi->n_rates; i++) {
                 struct minstrel_rate *mr = &mi->r[i];
                 struct minstrel_rate_stats *mrs = &mi->r[i].stats;
@@ -86,8 +86,8 @@ minstrel_stats_open(struct inode *inode, struct file *file)
                 prob = MINSTREL_TRUNC(mrs->cur_prob * 1000);
                 eprob = MINSTREL_TRUNC(mrs->probability * 1000);
 
-                p += sprintf(p, "  %6u.%1u   %6u.%1u   %6u.%1u        "
-                                "   %3u(%3u)  %8llu    %8llu\n",
+                p += sprintf(p, " %4u.%1u %3u.%1u %3u.%1u"
+                                " %4u(%4u) %9llu(%9llu)\n",
                                 tp / 10, tp % 10,
                                 eprob / 10, eprob % 10,
                                 prob / 10, prob % 10,
@@ -102,6 +102,8 @@ minstrel_stats_open(struct inode *inode, struct file *file)
                         mi->sample_packets);
         ms->len = p - ms->buf;
 
+        WARN_ON(ms->len + sizeof(*ms) > 2048);
+
         return 0;
 }
 
diff --git a/net/mac80211/rc80211_minstrel_ht_debugfs.c b/net/mac80211/rc80211_minstrel_ht_debugfs.c
index a72ad46f2a04..d537bec93754 100644
--- a/net/mac80211/rc80211_minstrel_ht_debugfs.c
+++ b/net/mac80211/rc80211_minstrel_ht_debugfs.c
@@ -63,8 +63,8 @@ minstrel_ht_stats_dump(struct minstrel_ht_sta *mi, int i, char *p)
                 prob = MINSTREL_TRUNC(mr->cur_prob * 1000);
                 eprob = MINSTREL_TRUNC(mr->probability * 1000);
 
-                p += sprintf(p, "      %6u.%1u   %6u.%1u    %6u.%1u    "
-                                "%3u            %3u(%3u)  %8llu    %8llu\n",
+                p += sprintf(p, " %4u.%1u %3u.%1u %3u.%1u "
+                                "%3u %4u(%4u) %9llu(%9llu)\n",
                                 tp / 10, tp % 10,
                                 eprob / 10, eprob % 10,
                                 prob / 10, prob % 10,
@@ -96,14 +96,15 @@ minstrel_ht_stats_open(struct inode *inode, struct file *file)
                 return ret;
         }
 
-        ms = kmalloc(sizeof(*ms) + 8192, GFP_KERNEL);
+        ms = kmalloc(8192, GFP_KERNEL);
         if (!ms)
                 return -ENOMEM;
 
         file->private_data = ms;
         p = ms->buf;
-        p += sprintf(p, "type           rate     throughput  ewma prob   "
-                     "this prob  retry   this succ/attempt   success    attempts\n");
+        p += sprintf(p, "type           rate     tpt eprob *prob "
+                        "ret  *ok(*cum)        ok(      cum)\n");
+
 
         p = minstrel_ht_stats_dump(mi, max_mcs, p);
         for (i = 0; i < max_mcs; i++)
@@ -118,6 +119,8 @@ minstrel_ht_stats_open(struct inode *inode, struct file *file)
                 MINSTREL_TRUNC(mi->avg_ampdu_len * 10) % 10);
         ms->len = p - ms->buf;
 
+        WARN_ON(ms->len + sizeof(*ms) > 8192);
+
         return nonseekable_open(inode, file);
 }