[PATCH] Fix buffer overflow and races in capi debug functions

The CAPI trace debug functions were using a fixed size buffer, which can be
overflowed if wrong formatted CAPI messages were sent to the kernel capi
layer.  The code was also not protected against multiple callers.  This fix
bug 8028.

Additionally the patch make the CAPI trace functions optional.

Signed-off-by: Karsten Keil <kkeil@suse.de>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

5 files changed, 318 insertions, 78 deletions

diff --git a/drivers/isdn/capi/Kconfig b/drivers/isdn/capi/Kconfig
index 8b6c9a431ffa..c921d6c522f5 100644
--- a/drivers/isdn/capi/Kconfig
+++ b/drivers/isdn/capi/Kconfig
@@ -2,13 +2,25 @@
 # Config.in for the CAPI subsystem
 #
 config ISDN_DRV_AVMB1_VERBOSE_REASON
-        bool "Verbose reason code reporting (kernel size +=7K)"
+        bool "Verbose reason code reporting"
         depends on ISDN_CAPI
+        default y
         help
-          If you say Y here, the AVM B1 driver will give verbose reasons for
+          If you say Y here, the CAPI drivers will give verbose reasons for
           disconnecting. This will increase the size of the kernel by 7 KB. If
           unsure, say Y.
 
+config CAPI_TRACE
+        bool "CAPI trace support"
+        depends on ISDN_CAPI
+        default y
+        help
+          If you say Y here, the kernelcapi driver can make verbose traces
+          of CAPI messages. This feature can be enabled/disabled via IOCTL for
+          every controler (default disabled).
+          This will increase the size of the kernelcapi module by 20 KB.
+          If unsure, say Y.
+
 config ISDN_CAPI_MIDDLEWARE
         bool "CAPI2.0 Middleware support (EXPERIMENTAL)"
         depends on ISDN_CAPI && EXPERIMENTAL
diff --git a/drivers/isdn/capi/capidrv.c b/drivers/isdn/capi/capidrv.c
index 2a49cea0a223..23b6f7bc16b7 100644
--- a/drivers/isdn/capi/capidrv.c
+++ b/drivers/isdn/capi/capidrv.c
@@ -990,6 +990,7 @@ static void handle_plci(_cmsg * cmsg)
         capidrv_contr *card = findcontrbynumber(cmsg->adr.adrController & 0x7f);
         capidrv_plci *plcip;
         isdn_ctrl cmd;
+        _cdebbuf *cdb;
 
         if (!card) {
                 printk(KERN_ERR "capidrv: %s from unknown controller 0x%x\n",
@@ -1122,8 +1123,15 @@ static void handle_plci(_cmsg * cmsg)
                                 break;
                         }
                 }
-                printk(KERN_ERR "capidrv-%d: %s\n",
-                                card->contrnr, capi_cmsg2str(cmsg));
+                cdb = capi_cmsg2str(cmsg);
+                if (cdb) {
+                        printk(KERN_WARNING "capidrv-%d: %s\n",
+                                card->contrnr, cdb->buf);
+                        cdebbuf_free(cdb);
+                } else
+                        printk(KERN_WARNING "capidrv-%d: CAPI_INFO_IND InfoNumber %x not handled\n",
+                                card->contrnr, cmsg->InfoNumber);
+
                 break;
 
         case CAPI_CONNECT_ACTIVE_CONF:          /* plci */
@@ -1371,10 +1379,18 @@ static _cmsg s_cmsg;
 static void capidrv_recv_message(struct capi20_appl *ap, struct sk_buff *skb)
 {
         capi_message2cmsg(&s_cmsg, skb->data);
-        if (debugmode > 3)
-                printk(KERN_DEBUG "capidrv_signal: applid=%d %s\n",
-                       ap->applid, capi_cmsg2str(&s_cmsg));
-        
+        if (debugmode > 3) {
+                _cdebbuf *cdb = capi_cmsg2str(&s_cmsg);
+
+                if (cdb) {
+                        printk(KERN_DEBUG "%s: applid=%d %s\n", __FUNCTION__,
+                                ap->applid, cdb->buf);
+                        cdebbuf_free(cdb);
+                } else
+                        printk(KERN_DEBUG "%s: applid=%d %s not traced\n",
+                                __FUNCTION__, ap->applid,
+                                capi_cmd2str(s_cmsg.Command, s_cmsg.Subcommand));
+        }
         if (s_cmsg.Command == CAPI_DATA_B3
             && s_cmsg.Subcommand == CAPI_IND) {
                 handle_data(&s_cmsg, skb);
diff --git a/drivers/isdn/capi/capiutil.c b/drivers/isdn/capi/capiutil.c
index c1b21552fc03..ad1e2702c2d1 100644
--- a/drivers/isdn/capi/capiutil.c
+++ b/drivers/isdn/capi/capiutil.c
@@ -648,6 +648,9 @@ char *capi_cmd2str(u8 cmd, u8 subcmd)
 
 
 /*-------------------------------------------------------*/
+
+#ifdef CONFIG_CAPI_TRACE
+
 /*-------------------------------------------------------*/
 
 static char *pnames[] =
@@ -703,44 +706,77 @@ static char *pnames[] =
 };
 
 
-static char buf[8192];
-static char *p = NULL;
 
 #include <stdarg.h>
 
 /*-------------------------------------------------------*/
-static void bufprint(char *fmt,...)
+static _cdebbuf *bufprint(_cdebbuf *cdb, char *fmt,...)
 {
         va_list f;
+        size_t n,r;
+
+        if (!cdb)
+                return NULL;
         va_start(f, fmt);
-        vsprintf(p, fmt, f);
+        r = cdb->size - cdb->pos;
+        n = vsnprintf(cdb->p, r, fmt, f);
         va_end(f);
-        p += strlen(p);
+        if (n >= r) {
+                /* truncated, need bigger buffer */
+                size_t ns = 2 * cdb->size;
+                u_char *nb;
+
+                while ((ns - cdb->pos) <= n)
+                        ns *= 2;
+                nb = kmalloc(ns, GFP_ATOMIC);
+                if (!nb) {
+                        cdebbuf_free(cdb);
+                        return NULL;
+                }
+                memcpy(nb, cdb->buf, cdb->pos);
+                kfree(cdb->buf);
+                nb[cdb->pos] = 0;
+                cdb->buf = nb;
+                cdb->p = cdb->buf + cdb->pos;
+                cdb->size = ns;
+                va_start(f, fmt);
+                r = cdb->size - cdb->pos;
+                n = vsnprintf(cdb->p, r, fmt, f);
+                va_end(f);
+        }
+        cdb->p += n;
+        cdb->pos += n;
+        return cdb;
 }
 
-static void printstructlen(u8 * m, unsigned len)
+static _cdebbuf *printstructlen(_cdebbuf *cdb, u8 * m, unsigned len)
 {
         unsigned hex = 0;
+
+        if (!cdb)
+                return NULL;
         for (; len; len--, m++)
                 if (isalnum(*m) || *m == ' ') {
                         if (hex)
-                                bufprint(">");
-                        bufprint("%c", *m);
+                                cdb = bufprint(cdb, ">");
+                        cdb = bufprint(cdb, "%c", *m);
                         hex = 0;
                 } else {
                         if (!hex)
-                                bufprint("<%02x", *m);
+                                cdb = bufprint(cdb, "<%02x", *m);