[PATCH] Fix buffer overflow and races in capi debug functions

The CAPI trace debug functions were using a fixed size buffer, which can be
overflowed if wrong formatted CAPI messages were sent to the kernel capi
layer.  The code was also not protected against multiple callers.  This fix
bug 8028.

Additionally the patch make the CAPI trace functions optional.

Signed-off-by: Karsten Keil <kkeil@suse.de>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

1 files changed, 22 insertions, 6 deletions

diff --git a/drivers/isdn/capi/capidrv.c b/drivers/isdn/capi/capidrv.c
index 2a49cea0a223..23b6f7bc16b7 100644
--- a/drivers/isdn/capi/capidrv.c
+++ b/drivers/isdn/capi/capidrv.c
@@ -990,6 +990,7 @@ static void handle_plci(_cmsg * cmsg)
         capidrv_contr *card = findcontrbynumber(cmsg->adr.adrController & 0x7f);
         capidrv_plci *plcip;
         isdn_ctrl cmd;
+        _cdebbuf *cdb;
 
         if (!card) {
                 printk(KERN_ERR "capidrv: %s from unknown controller 0x%x\n",
@@ -1122,8 +1123,15 @@ static void handle_plci(_cmsg * cmsg)
                                 break;
                         }
                 }
-                printk(KERN_ERR "capidrv-%d: %s\n",
-                                card->contrnr, capi_cmsg2str(cmsg));
+                cdb = capi_cmsg2str(cmsg);
+                if (cdb) {
+                        printk(KERN_WARNING "capidrv-%d: %s\n",
+                                card->contrnr, cdb->buf);
+                        cdebbuf_free(cdb);
+                } else
+                        printk(KERN_WARNING "capidrv-%d: CAPI_INFO_IND InfoNumber %x not handled\n",
+                                card->contrnr, cmsg->InfoNumber);
+
                 break;
 
         case CAPI_CONNECT_ACTIVE_CONF:          /* plci */
@@ -1371,10 +1379,18 @@ static _cmsg s_cmsg;
 static void capidrv_recv_message(struct capi20_appl *ap, struct sk_buff *skb)
 {
         capi_message2cmsg(&s_cmsg, skb->data);
-        if (debugmode > 3)
-                printk(KERN_DEBUG "capidrv_signal: applid=%d %s\n",
-                       ap->applid, capi_cmsg2str(&s_cmsg));
-        
+        if (debugmode > 3) {
+                _cdebbuf *cdb = capi_cmsg2str(&s_cmsg);
+
+                if (cdb) {
+                        printk(KERN_DEBUG "%s: applid=%d %s\n", __FUNCTION__,
+                                ap->applid, cdb->buf);
+                        cdebbuf_free(cdb);
+                } else
+                        printk(KERN_DEBUG "%s: applid=%d %s not traced\n",
+                                __FUNCTION__, ap->applid,
+                                capi_cmd2str(s_cmsg.Command, s_cmsg.Subcommand));
+        }
         if (s_cmsg.Command == CAPI_DATA_B3
             && s_cmsg.Subcommand == CAPI_IND) {
                 handle_data(&s_cmsg, skb);