2012-06-07 08:53:33

by Henrik Rydberg

Subject: [PATCH] hwmon: (applesmc) Limit key length in warning messages

Key lookups may call read_smc() with a fixed-length key string,
and if the lookup fails, trailing stack content may appear in the
kernel log. Fixed with this patch.

Signed-off-by: Henrik Rydberg <[email protected]>
---
drivers/hwmon/applesmc.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/hwmon/applesmc.c b/drivers/hwmon/applesmc.c
index f082e48..70d62f5 100644
--- a/drivers/hwmon/applesmc.c
+++ b/drivers/hwmon/applesmc.c
@@ -215,7 +215,7 @@ static int read_smc(u8 cmd, const char *key, u8 *buffer, u8 len)
int i;

if (send_command(cmd) || send_argument(key)) {
- pr_warn("%s: read arg fail\n", key);
+ pr_warn("%.4s: read arg fail\n", key);
return -EIO;
}

@@ -223,7 +223,7 @@ static int read_smc(u8 cmd, const char *key, u8 *buffer, u8 len)

for (i = 0; i < len; i++) {
if (__wait_status(0x05)) {
- pr_warn("%s: read data fail\n", key);
+ pr_warn("%.4s: read data fail\n", key);
return -EIO;
}
buffer[i] = inb(APPLESMC_DATA_PORT);
--
1.7.10.3

2012-06-07 13:41:12

by Guenter Roeck

Subject: Re: [PATCH] hwmon: (applesmc) Limit key length in warning messages

On Thu, Jun 07, 2012 at 04:54:29AM -0400, Henrik Rydberg wrote:
> Key lookups may call read_smc() with a fixed-length key string,
> and if the lookup fails, trailing stack content may appear in the
> kernel log. Fixed with this patch.
>
> Signed-off-by: Henrik Rydberg <[email protected]>

Applied.

Thanks,
Guenter