• Costantino Leandro's avatar
    wmi: fix kernel panic when stack protection enabled. · f3d83e24
    Costantino Leandro authored
    Summary:
    Kernel panic arise when stack protection is enabled, since strncat will
    add a null terminating byte '\0'; So in functions
    like this one (wmi_query_block):
            char wc[4]="WC";
    	....
    	strncat(method, block->object_id, 2);
            ...
    the length of wc should be n+1 (wc[5]) or stack protection
    fault will arise. This is not noticeable when stack protection is
    disabled,but , isn't good either.
    Config used: [CONFIG_CC_STACKPROTECTOR_ALL=y,
    	      CONFIG_CC_STACKPROTECTOR=y]
    
    Panic Trace
    ------------
           .... stack-protector: kernel stack corrupted in : fa7b182c
           2.6.30-rc8-obelisco-generic
           call_trace:
               [<c04a6c40>] ? panic+0x45/0xd9
    	   [<c012925d>] ? __stack_chk_fail+0x1c/0x40
    	   [<fa7b182c>] ? wmi_query_block+0x15a/0x162 [wmi]
    	   [<fa7b182c>] ? wmi_query_block+0x15a/0x162 [wmi]
    	   [<fa7e7000>] ? acer_wmi_init+0x00/0x61a [acer_wmi]
    	   [<fa7e7135>] ? acer_wmi_init+0x135/0x61a [acer_wmi]
    	   [<c0101159>] ? do_one_initcall+0x50+0x126
    
    Addresses http://bugzilla.kernel.org/show_bug.cgi?id=13514Signed-off-by: default avatarCostantino Leandro <lcostantino@gmail.com>
    Signed-off-by: default avatarCarlos Corbacho <carlos@strangeworlds.co.uk>
    Cc: Len Brown <len.brown@intel.com>
    Cc: Bjorn Helgaas <bjorn.helgaas@hp.com>
    Cc: "Rafael J. Wysocki" <rjw@sisk.pl>
    Cc: <stable@kernel.org>
    Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
    Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
    f3d83e24
wmi.c 17.2 KB