fix oops on rmmod capidrv

Fix overwriting the stack with the version string
(it is currently 10 bytes + zero) when unloading the
capidrv module. Safeguard against overwriting it
should the version string grow in the future.

Should fix Kernel Bug Tracker Bug 9696.

Signed-off-by: Gerd v. Egidy <gerd.von.egidy@intra2net.com>
Acked-by: Karsten Keil <kkeil@suse.de>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

diff --git a/drivers/isdn/capi/capidrv.c b/drivers/isdn/capi/capidrv.c
index 48c1775ef5b3de68404f90649b3ea9ede2d30d8a..cb42b690b45ee221b3f77a3ab967ced3864ba619 100644 (file)
--- a/drivers/isdn/capi/capidrv.c
+++ b/drivers/isdn/capi/capidrv.c
@@ -2332,13 +2332,14 @@ static int __init capidrv_init(void)
 
 static void __exit capidrv_exit(void)
 {
-       char rev[10];
+       char rev[32];
        char *p;
 
        if ((p = strchr(revision, ':')) != 0) {
-               strcpy(rev, p + 1);
-               p = strchr(rev, '$');
-               *p = 0;
+               strncpy(rev, p + 1, sizeof(rev));
+               rev[sizeof(rev)-1] = 0;
+               if ((p = strchr(rev, '$')) != 0)
+                       *p = 0;
        } else {
                strcpy(rev, " ??? ");
        }