From patchwork Tue Jun 9 21:09:23 2009 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "lcostantino@gmail.com" X-Patchwork-Id: 29082 Received: from vger.kernel.org (vger.kernel.org [209.132.176.167]) by demeter.kernel.org (8.14.2/8.14.2) with ESMTP id n59JJbKP004757 for ; Tue, 9 Jun 2009 19:19:38 GMT Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1750976AbZFITSo (ORCPT ); Tue, 9 Jun 2009 15:18:44 -0400 Received: (majordomo@vger.kernel.org) by vger.kernel.org id S1755648AbZFITSo (ORCPT ); Tue, 9 Jun 2009 15:18:44 -0400 Received: from mail-px0-f200.google.com ([209.85.216.200]:60940 "EHLO mail-px0-f200.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750976AbZFITSn (ORCPT ); Tue, 9 Jun 2009 15:18:43 -0400 Received: by pxi38 with SMTP id 38so131765pxi.33 for ; Tue, 09 Jun 2009 12:18:46 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:date:from:x-x-sender:to:cc :subject:message-id:user-agent:mime-version:content-type; bh=5nij7DWEGJ6dOTlDJpiV2rK2ShX4gQCqGilXJdLCFkU=; b=LfLY9e7qMStqz6bQ86LnIwN/e11hG2VnsRyE0JqleLf0ACOjtIGDJVNCYCf0dtEWQ1 sGXUXAZYlYzDBI++4HfPF4PNc/zIXEnp+AcnUDD/EaqPADe3ApdwoQdFk0vQR49mbB4A Nfu2bYgsVtMIUD1tXpCNNuALA6XkeIFbdod20= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=date:from:x-x-sender:to:cc:subject:message-id:user-agent :mime-version:content-type; b=bik2/B9pbr8O0/A9JO0WXOXVUZps2MF+Z08Udjkhuz+YCtleaDqTq+XY9eqKNArxgk SNCFtfFVjNJAcRjJyV8PB/DcJlMpxZNYio/rmQBAlBuLhY78rpejIVt96bRuPTGRsQCj ZUizOA6qpai8Kuyy9lysWn2isu6bhiYAGE668= Received: by 10.142.140.6 with SMTP id n6mr182047wfd.212.1244575126122; Tue, 09 Jun 2009 12:18:46 -0700 (PDT) Received: from ?192.168.0.2? (190_0_165_244.3g.solunet.com.ar [190.0.165.244]) by mx.google.com with ESMTPS id 22sm2645046wfg.27.2009.06.09.12.18.40 (version=TLSv1/SSLv3 cipher=RC4-MD5); Tue, 09 Jun 2009 12:18:45 -0700 (PDT) Date: Tue, 9 Jun 2009 17:09:23 -0400 (EDT) From: "lcostantino@gmail.com" X-X-Sender: root@debian To: carlos@strangeworlds.co.uk cc: linux-acpi@vger.kernel.org Subject: [PATCH] wmi: Fix kernel panic when stack protection enabled. Message-ID: User-Agent: Alpine 2.00 (DEB 1167 2008-08-23) MIME-Version: 1.0 Sender: linux-acpi-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-acpi@vger.kernel.org From: Costantino Leandro Summary: Kernel panic arise when stack protection is enabled, since strncat will add a null terminating byte '\0'; So in functions like this one (wmi_query_block): char wc[4]="WC"; .... strncat(method, block->object_id, 2); ... the length of wc should be n+1 (wc[5]) or stack protection fault will arise. This is not noticeable when stack protection is disabled,but , isn't good either. Config used: [CONFIG_CC_STACKPROTECTOR_ALL=y, CONFIG_CC_STACKPROTECTOR=y] Panic Trace ------------ .... stack-protector: kernel stack corrupted in : fa7b182c 2.6.30-rc8-obelisco-generic call_trace: [] ? panic+0x45/0xd9 [] ? __stack_chk_fail+0x1c/0x40 [] ? wmi_query_block+0x15a/0x162 [wmi] [] ? wmi_query_block+0x15a/0x162 [wmi] [] ? acer_wmi_init+0x00/0x61a [acer_wmi] [] ? acer_wmi_init+0x135/0x61a [acer_wmi] [] ? do_one_initcall+0x50+0x126 Signed-off-by: Costantino Leandro Acked-by: Carlos Corbacho --- drivers/platform/x86/wmi.c | 8 ++++---- 1 files changed, 4 insertions(+), 4 deletions(-) diff --git a/drivers/platform/x86/wmi.c b/drivers/platform/x86/wmi.c index 043b208..f215a59 100644 --- a/drivers/platform/x86/wmi.c +++ b/drivers/platform/x86/wmi.c @@ -270,7 +270,7 @@ u32 method_id, const struct acpi_buffer *in, struct acpi_buffer *out) acpi_status status; struct acpi_object_list input; union acpi_object params[3]; - char method[4] = "WM"; + char method[5] = "WM"; if (!find_guid(guid_string, &wblock)) return AE_ERROR; @@ -328,8 +328,8 @@ struct acpi_buffer *out) acpi_status status, wc_status = AE_ERROR; struct acpi_object_list input, wc_input; union acpi_object wc_params[1], wq_params[1]; - char method[4]; - char wc_method[4] = "WC"; + char method[5]; + char wc_method[5] = "WC"; if (!guid_string || !out) return AE_BAD_PARAMETER; @@ -410,7 +410,7 @@ const struct acpi_buffer *in) acpi_handle handle; struct acpi_object_list input; union acpi_object params[2]; - char method[4] = "WS"; + char method[5] = "WS"; if (!guid_string || !in) return AE_BAD_DATA;