Messages in this thread Patch in this message | | | Date | Wed, 6 Feb 2008 15:54:23 -0800 | From | Greg KH <> | Subject | [patch 66/73] fix oops on rmmod capidrv |
| |
2.6.23-stable review patch. If anyone has any objections, please let us know. ------------------ From: Karsten Keil <kkeil@suse.de>
patch eb36f4fc019835cecf0788907f6cab774508087b in mainline.
Fix overwriting the stack with the version string (it is currently 10 bytes + zero) when unloading the capidrv module. Safeguard against overwriting it should the version string grow in the future.
Should fix Kernel Bug Tracker Bug 9696.
Signed-off-by: Gerd v. Egidy <gerd.von.egidy@intra2net.com> Acked-by: Karsten Keil <kkeil@suse.de> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
--- drivers/isdn/capi/capidrv.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-)
--- a/drivers/isdn/capi/capidrv.c +++ b/drivers/isdn/capi/capidrv.c @@ -2306,13 +2306,14 @@ static int __init capidrv_init(void) static void __exit capidrv_exit(void) { - char rev[10]; + char rev[32]; char *p; if ((p = strchr(revision, ':')) != 0) { - strcpy(rev, p + 1); - p = strchr(rev, '$'); - *p = 0; + strncpy(rev, p + 1, sizeof(rev)); + rev[sizeof(rev)-1] = 0; + if ((p = strchr(rev, '$')) != 0) + *p = 0; } else { strcpy(rev, " ??? "); } --
| |