[PATCH] fix oops on rmmod capidrv

[PATCH] fix oops on rmmod capidrv

[Gerd v. Egidy]

Hi,

I think the patch below fixes a long-standing bug on rmmod capidrv. Please 
apply.

Kind regards,

Gerd

Fix overwriting the stack with the version string
(it is currently 10 bytes + zero) when unloading the
capidrv module. Safeguard against overwriting it
should the version string grow in the future.

Should fix Kernel Bug Tracker Bug 9696.

Signed-off-by: Gerd v. Egidy <gerd.von.egidy@intra2net.com>

diff -r -u linux-2.6.23.orig/drivers/isdn/capi/capidrv.c 
linux-2.6.23/drivers/isdn/capi/capidrv.c
--- linux-2.6.23.orig/drivers/isdn/capi/capidrv.c	Tue Oct  9 22:31:38 2007
+++ linux-2.6.23/drivers/isdn/capi/capidrv.c	Thu Jan 24 16:47:55 2008
@@ -2306,13 +2306,14 @@
 
 static void __exit capidrv_exit(void)
 {
-	char rev[10];
+	char rev[32];
 	char *p;
 
 	if ((p = strchr(revision, ':')) != 0) {
-		strcpy(rev, p + 1);
-		p = strchr(rev, '$');
-		*p = 0;
+		strncpy(rev, p + 1, sizeof(rev));
+		rev[sizeof(rev)-1] = 0;
+		if ((p = strchr(rev, '$')) != 0)
+			*p = 0;
 	} else {
 		strcpy(rev, " ??? ");
 	}

Re: [PATCH] fix oops on rmmod capidrv

[Gerd v. Egidy]

Hi,

my patch below was added to 2.6.23.15 and linus tree that became 2.6.25, but 
was too late for 2.6.24. So if you consider another stable release for 2.6.24 
you might want to add that patch too.

Kind regards,

Gerd

Fix overwriting the stack with the version string
(it is currently 10 bytes + zero) when unloading the
capidrv module. Safeguard against overwriting it
should the version string grow in the future.

Should fix Kernel Bug Tracker Bug 9696.

Signed-off-by: Gerd v. Egidy <gerd.von.egidy@intra2net.com>
Acked-by: Karsten Keil <kkeil@suse.de>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

--- a/drivers/isdn/capi/capidrv.c
+++ b/drivers/isdn/capi/capidrv.c
@@ -2306,13 +2306,14 @@ static int __init capidrv_init(void)
 
 static void __exit capidrv_exit(void)
 {
-	char rev[10];
+	char rev[32];
 	char *p;
 
 	if ((p = strchr(revision, ':')) != 0) {
-		strcpy(rev, p + 1);
-		p = strchr(rev, '$');
-		*p = 0;
+		strncpy(rev, p + 1, sizeof(rev));
+		rev[sizeof(rev)-1] = 0;
+		if ((p = strchr(rev, '$')) != 0)
+			*p = 0;
 	} else {
 		strcpy(rev, " ??? ");
 	}


-- 
Address (better: trap) for people I really don't want to get mail from:
joanne@cactusamerica.com

Re: [stable] [PATCH] fix oops on rmmod capidrv

[Greg KH]

On Tue, Apr 29, 2008 at 03:27:29PM +0200, Gerd v. Egidy wrote:
> Hi,
> 
> my patch below was added to 2.6.23.15 and linus tree that became 2.6.25, but 
> was too late for 2.6.24. So if you consider another stable release for 2.6.24 
> you might want to add that patch too.

Now added to the queue.

thanks,

greg k-h