litmus-rt.git - The LITMUS^RT kernel.

diff options

author	Dan Carpenter <error27@gmail.com>	2010-04-27 17:06:05 -0400
committer	Len Brown <len.brown@intel.com>	2010-05-06 02:38:25 -0400
commit	97c227cb51ddcf52c66f7a7fba69237026418b56 (patch)
tree	68833613ebe79fb7cec38d3ff0be3a457844fe5b /lib/timerqueue.c
parent	18262714ca0fb65c290b8ea1807b2b02bb52d0e3 (diff)

sbshc: acpi_device_class "smbus_host_controller" too long

acpi_device_class can only be 19 characters and a NULL terminator. With the current name we get a buffer overflow in acpi_smbus_hc_add() when we do: strcpy(acpi_device_class(device), ACPI_SMB_HC_CLASS); Signed-off-by: Dan Carpenter <error27@gmail.com> Cc: Alexey Starikovskiy <astarikovskiy@suse.de> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Len Brown <len.brown@intel.com>

Diffstat (limited to 'lib/timerqueue.c')

0 files changed, 0 insertions, 0 deletions

/* * ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by * the Free Software Foundation; either version 2 of the License, or (at * your option) any later version. * * This program is distributed in the hope that it will be useful, but * WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU * General Public License for more details. * * You should have received a copy of the GNU General Public License along * with this program; if not, write to the Free Software Foundation, Inc., * 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA. * * ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ */ #include <linux/kernel.h> #include <linux/module.h> #include <linux/init.h> #include <linux/acpi.h> #include <linux/types.h> #include <linux/proc_fs.h> #include <linux/seq_file.h> #include <acpi/acpi_bus.h> #include <acpi/acpi_drivers.h> #define PREFIX "ACPI: " ACPI_MODULE_NAME("cm_sbs"); #define ACPI_AC_CLASS "ac_adapter" #define ACPI_BATTERY_CLASS "battery" #define _COMPONENT ACPI_SBS_COMPONENT static struct proc_dir_entry *acpi_ac_dir; static struct proc_dir_entry *acpi_battery_dir; static DEFINE_MUTEX(cm_sbs_mutex); static int lock_ac_dir_cnt; static int lock_battery_dir_cnt; struct proc_dir_entry *acpi_lock_ac_dir(void) { mutex_lock(&cm_sbs_mutex); if (!acpi_ac_dir) acpi_ac_dir = proc_mkdir(ACPI_AC_CLASS, acpi_root_dir); if (acpi_ac_dir) { lock_ac_dir_cnt++; } else { printk(KERN_ERR PREFIX "Cannot create %s\n", ACPI_AC_CLASS); } mutex_unlock(&cm_sbs_mutex); return acpi_ac_dir; } EXPORT_SYMBOL(acpi_lock_ac_dir); void acpi_unlock_ac_dir(struct proc_dir_entry *acpi_ac_dir_param) { mutex_lock(&cm_sbs_mutex); if (acpi_ac_dir_param) lock_ac_dir_cnt--; if (lock_ac_dir_cnt == 0 && acpi_ac_dir_param && acpi_ac_dir) { remove_proc_entry(ACPI_AC_CLASS, acpi_root_dir); acpi_ac_dir = NULL; } mutex_unlock(&cm_sbs_mutex); } EXPORT_SYMBOL(acpi_unlock_ac_dir); struct proc_dir_entry *acpi_lock_battery_dir(void) { mutex_lock(&cm_sbs_mutex); if (!acpi_battery_dir) { acpi_battery_dir = proc_mkdir(ACPI_BATTERY_CLASS, acpi_root_dir); } if (acpi_battery_dir) { lock_battery_dir_cnt++; } else { printk(KERN_ERR PREFIX "Cannot create %s\n", ACPI_BATTERY_CLASS); } mutex_unlock(&cm_sbs_mutex); return acpi_battery_dir; } EXPORT_SYMBOL(acpi_lock_battery_dir); void acpi_unlock_battery_dir(struct proc_dir_entry *acpi_battery_dir_param) { mutex_lock(&cm_sbs_mutex); if (acpi_battery_dir_param) lock_battery_dir_cnt--; if (lock_battery_dir_cnt == 0 && acpi_battery_dir_param && acpi_battery_dir) { remove_proc_entry(ACPI_BATTERY_CLASS, acpi_root_dir); acpi_battery_dir = NULL; } mutex_unlock(&cm_sbs_mutex); return; } EXPORT_SYMBOL(acpi_unlock_battery_dir);


context:
space:
mode: