From: Dan Aloni <dan@aloni.org>
Date: Sat, 20 Jun 2009 13:32:22 +0000 (+0300)
Subject: Staging: prevent rtl8187se from crashing dev_ioctl() in SIOCGIWNAME
X-Git-Tag: v2.6.31-rc3~2^2~3
X-Git-Url: http://git.openpandora.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=02c8baecf5d8850dba40b47cdf003ed2e04e66dd;p=pandora-kernel.git

Staging: prevent rtl8187se from crashing dev_ioctl() in SIOCGIWNAME

I repeatedly get __stack_chk_fail panic()s with this driver before
applying the attached fix.

ieee80211_wx_get_name() ignores sizeof(wrqu->name) which is IFNAMSIZ (16), and
on certain conditions, the concatenated string will be larger than IFNAMSIZ
including the terminating zero.

    length ("802.11" ++ "b" ++ "/g" ++ " linked" ++ "\x00") == 17

This fix uses strl{cpy,cat} in addition to the reduction of the total
possible length of the output string by a char.

It can be applied to 2.6.30-stable as well.

Signed-off-by: Dan Aloni <dan@aloni.org>
Cc: Bartlomiej Zolnierkiewicz <bzolnier@gmail.com>
Cc: stable <stable@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---

Reading git-diff-tree failed