From: "Gerd v. Egidy" <gerd.von.egidy@intra2net.com>
Organization: Intra2net AG
To: linux-kernel@vger.kernel.org
Subject: [PATCH] fix oops on rmmod capidrv
Date: Thu, 24 Jan 2008 17:50:14 +0100
User-Agent: KMail/1.9.6
Cc: kkeil@suse.de, kai.germaschewski@gmx.de, isdn4linux@listserv.isdn4linux.de
MIME-Version: 1.0
Content-Type: text/plain;
  charset="us-ascii"
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
Message-Id: <200801241750.14669.gerd.von.egidy@intra2net.com>
Sender: linux-kernel-owner@vger.kernel.org
Content-Length: 1266
Lines: 46

Hi,

I think the patch below fixes a long-standing bug on rmmod capidrv. Please 
apply.

Kind regards,

Gerd

Fix overwriting the stack with the version string
(it is currently 10 bytes + zero) when unloading the
capidrv module. Safeguard against overwriting it
should the version string grow in the future.

Should fix Kernel Bug Tracker Bug 9696.

Signed-off-by: Gerd v. Egidy <gerd.von.egidy@intra2net.com>

diff -r -u linux-2.6.23.orig/drivers/isdn/capi/capidrv.c 
linux-2.6.23/drivers/isdn/capi/capidrv.c
--- linux-2.6.23.orig/drivers/isdn/capi/capidrv.c	Tue Oct  9 22:31:38 2007
+++ linux-2.6.23/drivers/isdn/capi/capidrv.c	Thu Jan 24 16:47:55 2008
@@ -2306,13 +2306,14 @@
 
 static void __exit capidrv_exit(void)
 {
-	char rev[10];
+	char rev[32];
 	char *p;
 
 	if ((p = strchr(revision, ':')) != 0) {
-		strcpy(rev, p + 1);
-		p = strchr(rev, '$');
-		*p = 0;
+		strncpy(rev, p + 1, sizeof(rev));
+		rev[sizeof(rev)-1] = 0;
+		if ((p = strchr(rev, '$')) != 0)
+			*p = 0;
 	} else {
 		strcpy(rev, " ??? ");
 	}
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/