From f3d83e2415445e5b157bef404d38674e9e8de169 Mon Sep 17 00:00:00 2001 From: Costantino Leandro Date: Wed, 26 Aug 2009 14:29:28 -0700 Subject: wmi: fix kernel panic when stack protection enabled. Summary: Kernel panic arise when stack protection is enabled, since strncat will add a null terminating byte '\0'; So in functions like this one (wmi_query_block): char wc[4]="WC"; .... strncat(method, block->object_id, 2); ... the length of wc should be n+1 (wc[5]) or stack protection fault will arise. This is not noticeable when stack protection is disabled,but , isn't good either. Config used: [CONFIG_CC_STACKPROTECTOR_ALL=y, CONFIG_CC_STACKPROTECTOR=y] Panic Trace ------------ .... stack-protector: kernel stack corrupted in : fa7b182c 2.6.30-rc8-obelisco-generic call_trace: [] ? panic+0x45/0xd9 [] ? __stack_chk_fail+0x1c/0x40 [] ? wmi_query_block+0x15a/0x162 [wmi] [] ? wmi_query_block+0x15a/0x162 [wmi] [] ? acer_wmi_init+0x00/0x61a [acer_wmi] [] ? acer_wmi_init+0x135/0x61a [acer_wmi] [] ? do_one_initcall+0x50+0x126 Addresses http://bugzilla.kernel.org/show_bug.cgi?id=13514 Signed-off-by: Costantino Leandro Signed-off-by: Carlos Corbacho Cc: Len Brown Cc: Bjorn Helgaas Cc: "Rafael J. Wysocki" Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds --- drivers/platform/x86/wmi.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) (limited to 'drivers/platform') diff --git a/drivers/platform/x86/wmi.c b/drivers/platform/x86/wmi.c index 043b208d971..f215a591919 100644 --- a/drivers/platform/x86/wmi.c +++ b/drivers/platform/x86/wmi.c @@ -270,7 +270,7 @@ u32 method_id, const struct acpi_buffer *in, struct acpi_buffer *out) acpi_status status; struct acpi_object_list input; union acpi_object params[3]; - char method[4] = "WM"; + char method[5] = "WM"; if (!find_guid(guid_string, &wblock)) return AE_ERROR; @@ -328,8 +328,8 @@ struct acpi_buffer *out) acpi_status status, wc_status = AE_ERROR; struct acpi_object_list input, wc_input; union acpi_object wc_params[1], wq_params[1]; - char method[4]; - char wc_method[4] = "WC"; + char method[5]; + char wc_method[5] = "WC"; if (!guid_string || !out) return AE_BAD_PARAMETER; @@ -410,7 +410,7 @@ const struct acpi_buffer *in) acpi_handle handle; struct acpi_object_list input; union acpi_object params[2]; - char method[4] = "WS"; + char method[5] = "WS"; if (!guid_string || !in) return AE_BAD_DATA; -- cgit v1.2.3 From 82e7784f57a81faf673b09bc468e736d582fe754 Mon Sep 17 00:00:00 2001 From: Jiri Slaby Date: Thu, 6 Aug 2009 15:57:51 -0700 Subject: toshiba_acpi: return on a fail path Return from bt_rfkill_poll() when hci_get_radio_state() fails. value is invalid in that case and should not be assigned to the rfkill state. This also fixes a double unlock bug. Signed-off-by: Jiri Slaby Cc: John W. Linville Cc: Johannes Berg Cc: Henrique de Moraes Holschuh Signed-off-by: Andrew Morton Signed-off-by: Len Brown --- drivers/platform/x86/toshiba_acpi.c | 1 + 1 file changed, 1 insertion(+) (limited to 'drivers/platform') diff --git a/drivers/platform/x86/toshiba_acpi.c b/drivers/platform/x86/toshiba_acpi.c index 81d31ea507d..51c0a8bee41 100644 --- a/drivers/platform/x86/toshiba_acpi.c +++ b/drivers/platform/x86/toshiba_acpi.c @@ -335,6 +335,7 @@ static void bt_rfkill_poll(struct rfkill *rfkill, void *data) if (hci_result != HCI_SUCCESS) { /* Can't do anything useful */ mutex_unlock(&dev->mutex); + return; } new_rfk_state = value; -- cgit v1.2.3