I repeatedly get __stack_chk_fail panic()s with this driver before applying the attached fix. ieee80211_wx_get_name() ignores sizeof(wrqu->name) which is IFNAMSIZ (16), and on certain conditions, the concatenated string will be larger than IFNAMSIZ including the terminating zero. length ("802.11" ++ "b" ++ "/g" ++ " linked" ++ "\x00") == 17 This fix uses strl{cpy,cat} in addition to the reduction of the total possible length of the output string by a char. It can be applied to 2.6.30-stable as well. Signed-off-by: Dan Aloni <dan@aloni.org> Cc: Bartlomiej Zolnierkiewicz <bzolnier@gmail.com> Cc: stable <stable@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> |
||
---|---|---|
.. | ||
ieee80211 | ||
Kconfig | ||
Makefile | ||
dot11d.h | ||
ieee80211.h | ||
ieee80211_crypt.h | ||
r8180.h | ||
r8180_93cx6.c | ||
r8180_93cx6.h | ||
r8180_core.c | ||
r8180_dm.c | ||
r8180_dm.h | ||
r8180_gct.c | ||
r8180_gct.h | ||
r8180_hw.h | ||
r8180_max2820.c | ||
r8180_max2820.h | ||
r8180_pm.c | ||
r8180_pm.h | ||
r8180_rtl8225.c | ||
r8180_rtl8225.h | ||
r8180_rtl8225z2.c | ||
r8180_rtl8255.c | ||
r8180_rtl8255.h | ||
r8180_sa2400.c | ||
r8180_sa2400.h | ||
r8180_wx.c | ||
r8180_wx.h | ||
r8185b_init.c |