lkml.org 
[lkml]   [2008]   [Apr]   [29]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
Date
From
Subject[02/12] fix oops on rmmod capidrv
2.6.24-stable review patch.  If anyone has any objections, please let us
know.

------------------

From: Karsten Keil <kkeil@suse.de>

commit eb36f4fc019835cecf0788907f6cab774508087b upstream.

Fix overwriting the stack with the version string
(it is currently 10 bytes + zero) when unloading the
capidrv module. Safeguard against overwriting it
should the version string grow in the future.

Should fix Kernel Bug Tracker Bug 9696.

Signed-off-by: Gerd v. Egidy <gerd.von.egidy@intra2net.com>
Acked-by: Karsten Keil <kkeil@suse.de>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

---
drivers/isdn/capi/capidrv.c | 9 +++++----
1 file changed, 5 insertions(+), 4 deletions(-)

--- a/drivers/isdn/capi/capidrv.c
+++ b/drivers/isdn/capi/capidrv.c
@@ -2332,13 +2332,14 @@ static int __init capidrv_init(void)

static void __exit capidrv_exit(void)
{
- char rev[10];
+ char rev[32];
char *p;

if ((p = strchr(revision, ':')) != 0) {
- strcpy(rev, p + 1);
- p = strchr(rev, '$');
- *p = 0;
+ strncpy(rev, p + 1, sizeof(rev));
+ rev[sizeof(rev)-1] = 0;
+ if ((p = strchr(rev, '$')) != 0)
+ *p = 0;
} else {
strcpy(rev, " ??? ");
}
--


\
 
 \ /
  Last update: 2008-04-29 20:55    [W:0.074 / U:0.420 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site