Commit f3d83e24 authored by Costantino Leandro's avatar Costantino Leandro Committed by Linus Torvalds

wmi: fix kernel panic when stack protection enabled.

Summary:
Kernel panic arise when stack protection is enabled, since strncat will
add a null terminating byte '\0'; So in functions
like this one (wmi_query_block):
        char wc[4]="WC";
	....
	strncat(method, block->object_id, 2);
        ...
the length of wc should be n+1 (wc[5]) or stack protection
fault will arise. This is not noticeable when stack protection is
disabled,but , isn't good either.
Config used: [CONFIG_CC_STACKPROTECTOR_ALL=y,
	      CONFIG_CC_STACKPROTECTOR=y]

Panic Trace
------------
       .... stack-protector: kernel stack corrupted in : fa7b182c
       2.6.30-rc8-obelisco-generic
       call_trace:
           [<c04a6c40>] ? panic+0x45/0xd9
	   [<c012925d>] ? __stack_chk_fail+0x1c/0x40
	   [<fa7b182c>] ? wmi_query_block+0x15a/0x162 [wmi]
	   [<fa7b182c>] ? wmi_query_block+0x15a/0x162 [wmi]
	   [<fa7e7000>] ? acer_wmi_init+0x00/0x61a [acer_wmi]
	   [<fa7e7135>] ? acer_wmi_init+0x135/0x61a [acer_wmi]
	   [<c0101159>] ? do_one_initcall+0x50+0x126

Addresses http://bugzilla.kernel.org/show_bug.cgi?id=13514Signed-off-by: default avatarCostantino Leandro <lcostantino@gmail.com>
Signed-off-by: default avatarCarlos Corbacho <carlos@strangeworlds.co.uk>
Cc: Len Brown <len.brown@intel.com>
Cc: Bjorn Helgaas <bjorn.helgaas@hp.com>
Cc: "Rafael J. Wysocki" <rjw@sisk.pl>
Cc: <stable@kernel.org>
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
parent ce8442b5
...@@ -270,7 +270,7 @@ u32 method_id, const struct acpi_buffer *in, struct acpi_buffer *out) ...@@ -270,7 +270,7 @@ u32 method_id, const struct acpi_buffer *in, struct acpi_buffer *out)
acpi_status status; acpi_status status;
struct acpi_object_list input; struct acpi_object_list input;
union acpi_object params[3]; union acpi_object params[3];
char method[4] = "WM"; char method[5] = "WM";
if (!find_guid(guid_string, &wblock)) if (!find_guid(guid_string, &wblock))
return AE_ERROR; return AE_ERROR;
...@@ -328,8 +328,8 @@ struct acpi_buffer *out) ...@@ -328,8 +328,8 @@ struct acpi_buffer *out)
acpi_status status, wc_status = AE_ERROR; acpi_status status, wc_status = AE_ERROR;
struct acpi_object_list input, wc_input; struct acpi_object_list input, wc_input;
union acpi_object wc_params[1], wq_params[1]; union acpi_object wc_params[1], wq_params[1];
char method[4]; char method[5];
char wc_method[4] = "WC"; char wc_method[5] = "WC";
if (!guid_string || !out) if (!guid_string || !out)
return AE_BAD_PARAMETER; return AE_BAD_PARAMETER;
...@@ -410,7 +410,7 @@ const struct acpi_buffer *in) ...@@ -410,7 +410,7 @@ const struct acpi_buffer *in)
acpi_handle handle; acpi_handle handle;
struct acpi_object_list input; struct acpi_object_list input;
union acpi_object params[2]; union acpi_object params[2];
char method[4] = "WS"; char method[5] = "WS";
if (!guid_string || !in) if (!guid_string || !in)
return AE_BAD_DATA; return AE_BAD_DATA;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment