Messages in this thread Patch in this message | | | From | "Gerd v. Egidy" <> | Subject | [PATCH] fix oops on rmmod capidrv | Date | Thu, 24 Jan 2008 17:50:14 +0100 |
| |
Hi,
I think the patch below fixes a long-standing bug on rmmod capidrv. Please apply.
Kind regards,
Gerd
Fix overwriting the stack with the version string (it is currently 10 bytes + zero) when unloading the capidrv module. Safeguard against overwriting it should the version string grow in the future.
Should fix Kernel Bug Tracker Bug 9696.
Signed-off-by: Gerd v. Egidy <gerd.von.egidy@intra2net.com>
diff -r -u linux-2.6.23.orig/drivers/isdn/capi/capidrv.c linux-2.6.23/drivers/isdn/capi/capidrv.c --- linux-2.6.23.orig/drivers/isdn/capi/capidrv.c Tue Oct 9 22:31:38 2007 +++ linux-2.6.23/drivers/isdn/capi/capidrv.c Thu Jan 24 16:47:55 2008 @@ -2306,13 +2306,14 @@ static void __exit capidrv_exit(void) { - char rev[10]; + char rev[32]; char *p; if ((p = strchr(revision, ':')) != 0) { - strcpy(rev, p + 1); - p = strchr(rev, '$'); - *p = 0; + strncpy(rev, p + 1, sizeof(rev)); + rev[sizeof(rev)-1] = 0; + if ((p = strchr(rev, '$')) != 0) + *p = 0; } else { strcpy(rev, " ??? "); }
| |