diff options
author | Costantino Leandro <lcostantino@gmail.com> | 2009-08-26 17:29:28 -0400 |
---|---|---|
committer | Linus Torvalds <torvalds@linux-foundation.org> | 2009-08-26 23:06:53 -0400 |
commit | f3d83e2415445e5b157bef404d38674e9e8de169 (patch) | |
tree | adc92f5fd348427802e0768aa2aaabe9a409970d /drivers | |
parent | ce8442b55135c679809311997d1446f3bbc05de2 (diff) |
wmi: fix kernel panic when stack protection enabled.
Summary:
Kernel panic arise when stack protection is enabled, since strncat will
add a null terminating byte '\0'; So in functions
like this one (wmi_query_block):
char wc[4]="WC";
....
strncat(method, block->object_id, 2);
...
the length of wc should be n+1 (wc[5]) or stack protection
fault will arise. This is not noticeable when stack protection is
disabled,but , isn't good either.
Config used: [CONFIG_CC_STACKPROTECTOR_ALL=y,
CONFIG_CC_STACKPROTECTOR=y]
Panic Trace
------------
.... stack-protector: kernel stack corrupted in : fa7b182c
2.6.30-rc8-obelisco-generic
call_trace:
[<c04a6c40>] ? panic+0x45/0xd9
[<c012925d>] ? __stack_chk_fail+0x1c/0x40
[<fa7b182c>] ? wmi_query_block+0x15a/0x162 [wmi]
[<fa7b182c>] ? wmi_query_block+0x15a/0x162 [wmi]
[<fa7e7000>] ? acer_wmi_init+0x00/0x61a [acer_wmi]
[<fa7e7135>] ? acer_wmi_init+0x135/0x61a [acer_wmi]
[<c0101159>] ? do_one_initcall+0x50+0x126
Addresses http://bugzilla.kernel.org/show_bug.cgi?id=13514
Signed-off-by: Costantino Leandro <lcostantino@gmail.com>
Signed-off-by: Carlos Corbacho <carlos@strangeworlds.co.uk>
Cc: Len Brown <len.brown@intel.com>
Cc: Bjorn Helgaas <bjorn.helgaas@hp.com>
Cc: "Rafael J. Wysocki" <rjw@sisk.pl>
Cc: <stable@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Diffstat (limited to 'drivers')
-rw-r--r-- | drivers/platform/x86/wmi.c | 8 |
1 files changed, 4 insertions, 4 deletions
diff --git a/drivers/platform/x86/wmi.c b/drivers/platform/x86/wmi.c index 043b208d971d..f215a5919192 100644 --- a/drivers/platform/x86/wmi.c +++ b/drivers/platform/x86/wmi.c | |||
@@ -270,7 +270,7 @@ u32 method_id, const struct acpi_buffer *in, struct acpi_buffer *out) | |||
270 | acpi_status status; | 270 | acpi_status status; |
271 | struct acpi_object_list input; | 271 | struct acpi_object_list input; |
272 | union acpi_object params[3]; | 272 | union acpi_object params[3]; |
273 | char method[4] = "WM"; | 273 | char method[5] = "WM"; |
274 | 274 | ||
275 | if (!find_guid(guid_string, &wblock)) | 275 | if (!find_guid(guid_string, &wblock)) |
276 | return AE_ERROR; | 276 | return AE_ERROR; |
@@ -328,8 +328,8 @@ struct acpi_buffer *out) | |||
328 | acpi_status status, wc_status = AE_ERROR; | 328 | acpi_status status, wc_status = AE_ERROR; |
329 | struct acpi_object_list input, wc_input; | 329 | struct acpi_object_list input, wc_input; |
330 | union acpi_object wc_params[1], wq_params[1]; | 330 | union acpi_object wc_params[1], wq_params[1]; |
331 | char method[4]; | 331 | char method[5]; |
332 | char wc_method[4] = "WC"; | 332 | char wc_method[5] = "WC"; |
333 | 333 | ||
334 | if (!guid_string || !out) | 334 | if (!guid_string || !out) |
335 | return AE_BAD_PARAMETER; | 335 | return AE_BAD_PARAMETER; |
@@ -410,7 +410,7 @@ const struct acpi_buffer *in) | |||
410 | acpi_handle handle; | 410 | acpi_handle handle; |
411 | struct acpi_object_list input; | 411 | struct acpi_object_list input; |
412 | union acpi_object params[2]; | 412 | union acpi_object params[2]; |
413 | char method[4] = "WS"; | 413 | char method[5] = "WS"; |
414 | 414 | ||
415 | if (!guid_string || !in) | 415 | if (!guid_string || !in) |
416 | return AE_BAD_DATA; | 416 | return AE_BAD_DATA; |