Skip to content

Commit f353078

Browse files
torvaldstorvalds
committed
Merge branch 'akpm' (patches from Andrew)
Merge misc fixes from Andrew Morton: "11 fixes" * emailed patches form Andrew Morton <[email protected]>: reiserfs: fix buffer overflow with long warning messages checkpatch: fix duplicate invalid vsprintf pointer extension '%p<foo>' messages mm: do not bug_on on incorrect length in __mm_populate() mm/memblock.c: do not complain about top-down allocations for !MEMORY_HOTREMOVE fs, elf: make sure to page align bss in load_elf_library x86/purgatory: add missing FORCE to Makefile target net/9p/client.c: put refcount of trans_mod in error case in parse_opts() mm: allow arch to supply p??_free_tlb functions autofs: fix slab out of bounds read in getname_kernel() fs/proc/task_mmu.c: fix Locked field in /proc/pid/smaps* mm: do not drop unused pages when userfaultd is running
2 parents e181ae0 + fe10e39 commit f353078

File tree

12 files changed

+133
-99
lines changed

12 files changed

+133
-99
lines changed

‎arch/x86/purgatory/Makefile

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ purgatory-y := purgatory.o stack.o setup-x86_$(BITS).o sha256.o entry64.o string
66
targets += $(purgatory-y)
77
PURGATORY_OBJS = $(addprefix $(obj)/,$(purgatory-y))
88

9-
$(obj)/sha256.o: $(srctree)/lib/sha256.c
9+
$(obj)/sha256.o: $(srctree)/lib/sha256.c FORCE
1010
$(call if_changed_rule,cc_o_c)
1111

1212
LDFLAGS_purgatory.ro := -e purgatory_start -r --no-undefined -nostdlib -z nodefaultlib

‎fs/autofs/dev-ioctl.c

Lines changed: 13 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -135,6 +135,15 @@ static int validate_dev_ioctl(int cmd, struct autofs_dev_ioctl *param)
135135
cmd);
136136
goto out;
137137
}
138+
} else {
139+
unsigned int inr = _IOC_NR(cmd);
140+
141+
if (inr == AUTOFS_DEV_IOCTL_OPENMOUNT_CMD ||
142+
inr == AUTOFS_DEV_IOCTL_REQUESTER_CMD ||
143+
inr == AUTOFS_DEV_IOCTL_ISMOUNTPOINT_CMD) {
144+
err = -EINVAL;
145+
goto out;
146+
}
138147
}
139148

140149
err = 0;
@@ -271,7 +280,8 @@ static int autofs_dev_ioctl_openmount(struct file *fp,
271280
dev_t devid;
272281
int err, fd;
273282

274-
/* param->path has already been checked */
283+
/* param->path has been checked in validate_dev_ioctl() */
284+
275285
if (!param->openmount.devid)
276286
return -EINVAL;
277287

@@ -433,10 +443,7 @@ static int autofs_dev_ioctl_requester(struct file *fp,
433443
dev_t devid;
434444
int err = -ENOENT;
435445

436-
if (param->size <= AUTOFS_DEV_IOCTL_SIZE) {
437-
err = -EINVAL;
438-
goto out;
439-
}
446+
/* param->path has been checked in validate_dev_ioctl() */
440447

441448
devid = sbi->sb->s_dev;
442449

@@ -521,10 +528,7 @@ static int autofs_dev_ioctl_ismountpoint(struct file *fp,
521528
unsigned int devid, magic;
522529
int err = -ENOENT;
523530

524-
if (param->size <= AUTOFS_DEV_IOCTL_SIZE) {
525-
err = -EINVAL;
526-
goto out;
527-
}
531+
/* param->path has been checked in validate_dev_ioctl() */
528532

529533
name = param->path;
530534
type = param->ismountpoint.in.type;

‎fs/binfmt_elf.c

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1259,9 +1259,8 @@ static int load_elf_library(struct file *file)
12591259
goto out_free_ph;
12601260
}
12611261

1262-
len = ELF_PAGESTART(eppnt->p_filesz + eppnt->p_vaddr +
1263-
ELF_MIN_ALIGN - 1);
1264-
bss = eppnt->p_memsz + eppnt->p_vaddr;
1262+
len = ELF_PAGEALIGN(eppnt->p_filesz + eppnt->p_vaddr);
1263+
bss = ELF_PAGEALIGN(eppnt->p_memsz + eppnt->p_vaddr);
12651264
if (bss > len) {
12661265
error = vm_brk(len, bss - len);
12671266
if (error)

‎fs/proc/task_mmu.c

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -831,7 +831,8 @@ static int show_smap(struct seq_file *m, void *v, int is_pid)
831831
SEQ_PUT_DEC(" kB\nSwap: ", mss->swap);
832832
SEQ_PUT_DEC(" kB\nSwapPss: ",
833833
mss->swap_pss >> PSS_SHIFT);
834-
SEQ_PUT_DEC(" kB\nLocked: ", mss->pss >> PSS_SHIFT);
834+
SEQ_PUT_DEC(" kB\nLocked: ",
835+
mss->pss_locked >> PSS_SHIFT);
835836
seq_puts(m, " kB\n");
836837
}
837838
if (!rollup_mode) {

‎fs/reiserfs/prints.c

Lines changed: 81 additions & 60 deletions
Original file line numberDiff line numberDiff line change
@@ -76,83 +76,99 @@ static char *le_type(struct reiserfs_key *key)
7676
}
7777

7878
/* %k */
79-
static void sprintf_le_key(char *buf, struct reiserfs_key *key)
79+
static int scnprintf_le_key(char *buf, size_t size, struct reiserfs_key *key)
8080
{
8181
if (key)
82-
sprintf(buf, "[%d %d %s %s]", le32_to_cpu(key->k_dir_id),
83-
le32_to_cpu(key->k_objectid), le_offset(key),
84-
le_type(key));
82+
return scnprintf(buf, size, "[%d %d %s %s]",
83+
le32_to_cpu(key->k_dir_id),
84+
le32_to_cpu(key->k_objectid), le_offset(key),
85+
le_type(key));
8586
else
86-
sprintf(buf, "[NULL]");
87+
return scnprintf(buf, size, "[NULL]");
8788
}
8889

8990
/* %K */
90-
static void sprintf_cpu_key(char *buf, struct cpu_key *key)
91+
static int scnprintf_cpu_key(char *buf, size_t size, struct cpu_key *key)
9192
{
9293
if (key)
93-
sprintf(buf, "[%d %d %s %s]", key->on_disk_key.k_dir_id,
94-
key->on_disk_key.k_objectid, reiserfs_cpu_offset(key),
95-
cpu_type(key));
94+
return scnprintf(buf, size, "[%d %d %s %s]",
95+
key->on_disk_key.k_dir_id,
96+
key->on_disk_key.k_objectid,
97+
reiserfs_cpu_offset(key), cpu_type(key));
9698
else
97-
sprintf(buf, "[NULL]");
99+
return scnprintf(buf, size, "[NULL]");
98100
}
99101

100-
static void sprintf_de_head(char *buf, struct reiserfs_de_head *deh)
102+
static int scnprintf_de_head(char *buf, size_t size,
103+
struct reiserfs_de_head *deh)
101104
{
102105
if (deh)
103-
sprintf(buf,
104-
"[offset=%d dir_id=%d objectid=%d location=%d state=%04x]",
105-
deh_offset(deh), deh_dir_id(deh), deh_objectid(deh),
106-
deh_location(deh), deh_state(deh));
106+
return scnprintf(buf, size,
107+
"[offset=%d dir_id=%d objectid=%d location=%d state=%04x]",
108+
deh_offset(deh), deh_dir_id(deh),
109+
deh_objectid(deh), deh_location(deh),
110+
deh_state(deh));
107111
else
108-
sprintf(buf, "[NULL]");
112+
return scnprintf(buf, size, "[NULL]");
109113

110114
}
111115

112-
static void sprintf_item_head(char *buf, struct item_head *ih)
116+
static int scnprintf_item_head(char *buf, size_t size, struct item_head *ih)
113117
{
114118
if (ih) {
115-
strcpy(buf,
116-
(ih_version(ih) == KEY_FORMAT_3_6) ? "*3.6* " : "*3.5*");
117-
sprintf_le_key(buf + strlen(buf), &(ih->ih_key));
118-
sprintf(buf + strlen(buf), ", item_len %d, item_location %d, "
119-
"free_space(entry_count) %d",
120-
ih_item_len(ih), ih_location(ih), ih_free_space(ih));
119+
char *p = buf;
120+
char * const end = buf + size;
121+
122+
p += scnprintf(p, end - p, "%s",
123+
(ih_version(ih) == KEY_FORMAT_3_6) ?
124+
"*3.6* " : "*3.5*");
125+
126+
p += scnprintf_le_key(p, end - p, &ih->ih_key);
127+
128+
p += scnprintf(p, end - p,
129+
", item_len %d, item_location %d, free_space(entry_count) %d",
130+
ih_item_len(ih), ih_location(ih),
131+
ih_free_space(ih));
132+
return p - buf;
121133
} else
122-
sprintf(buf, "[NULL]");
134+
return scnprintf(buf, size, "[NULL]");
123135
}
124136

125-
static void sprintf_direntry(char *buf, struct reiserfs_dir_entry *de)
137+
static int scnprintf_direntry(char *buf, size_t size,
138+
struct reiserfs_dir_entry *de)
126139
{
127140
char name[20];
128141

129142
memcpy(name, de->de_name, de->de_namelen > 19 ? 19 : de->de_namelen);
130143
name[de->de_namelen > 19 ? 19 : de->de_namelen] = 0;
131-
sprintf(buf, "\"%s\"==>[%d %d]", name, de->de_dir_id, de->de_objectid);
144+
return scnprintf(buf, size, "\"%s\"==>[%d %d]",
145+
name, de->de_dir_id, de->de_objectid);
132146
}
133147

134-
static void sprintf_block_head(char *buf, struct buffer_head *bh)
148+
static int scnprintf_block_head(char *buf, size_t size, struct buffer_head *bh)
135149
{
136-
sprintf(buf, "level=%d, nr_items=%d, free_space=%d rdkey ",
137-
B_LEVEL(bh), B_NR_ITEMS(bh), B_FREE_SPACE(bh));
150+
return scnprintf(buf, size,
151+
"level=%d, nr_items=%d, free_space=%d rdkey ",
152+
B_LEVEL(bh), B_NR_ITEMS(bh), B_FREE_SPACE(bh));
138153
}
139154

140-
static void sprintf_buffer_head(char *buf, struct buffer_head *bh)
155+
static int scnprintf_buffer_head(char *buf, size_t size, struct buffer_head *bh)
141156
{
142-
sprintf(buf,
143-
"dev %pg, size %zd, blocknr %llu, count %d, state 0x%lx, page %p, (%s, %s, %s)",
144-
bh->b_bdev, bh->b_size,
145-
(unsigned long long)bh->b_blocknr, atomic_read(&(bh->b_count)),
146-
bh->b_state, bh->b_page,
147-
buffer_uptodate(bh) ? "UPTODATE" : "!UPTODATE",
148-
buffer_dirty(bh) ? "DIRTY" : "CLEAN",
149-
buffer_locked(bh) ? "LOCKED" : "UNLOCKED");
157+
return scnprintf(buf, size,
158+
"dev %pg, size %zd, blocknr %llu, count %d, state 0x%lx, page %p, (%s, %s, %s)",
159+
bh->b_bdev, bh->b_size,
160+
(unsigned long long)bh->b_blocknr,
161+
atomic_read(&(bh->b_count)),
162+
bh->b_state, bh->b_page,
163+
buffer_uptodate(bh) ? "UPTODATE" : "!UPTODATE",
164+
buffer_dirty(bh) ? "DIRTY" : "CLEAN",
165+
buffer_locked(bh) ? "LOCKED" : "UNLOCKED");
150166
}
151167

152-
static void sprintf_disk_child(char *buf, struct disk_child *dc)
168+
static int scnprintf_disk_child(char *buf, size_t size, struct disk_child *dc)
153169
{
154-
sprintf(buf, "[dc_number=%d, dc_size=%u]", dc_block_number(dc),
155-
dc_size(dc));
170+
return scnprintf(buf, size, "[dc_number=%d, dc_size=%u]",
171+
dc_block_number(dc), dc_size(dc));
156172
}
157173

158174
static char *is_there_reiserfs_struct(char *fmt, int *what)
@@ -189,55 +205,60 @@ static void prepare_error_buf(const char *fmt, va_list args)
189205
char *fmt1 = fmt_buf;
190206
char *k;
191207
char *p = error_buf;
208+
char * const end = &error_buf[sizeof(error_buf)];
192209
int what;
193210

194211
spin_lock(&error_lock);
195212

196-
strcpy(fmt1, fmt);
213+
if (WARN_ON(strscpy(fmt_buf, fmt, sizeof(fmt_buf)) < 0)) {
214+
strscpy(error_buf, "format string too long", end - error_buf);
215+
goto out_unlock;
216+
}
197217

198218
while ((k = is_there_reiserfs_struct(fmt1, &what)) != NULL) {
199219
*k = 0;
200220

201-
p += vsprintf(p, fmt1, args);
221+
p += vscnprintf(p, end - p, fmt1, args);
202222

203223
switch (what) {
204224
case 'k':
205-
sprintf_le_key(p, va_arg(args, struct reiserfs_key *));
225+
p += scnprintf_le_key(p, end - p,
226+
va_arg(args, struct reiserfs_key *));
206227
break;
207228
case 'K':
208-
sprintf_cpu_key(p, va_arg(args, struct cpu_key *));
229+
p += scnprintf_cpu_key(p, end - p,
230+
va_arg(args, struct cpu_key *));
209231
break;
210232
case 'h':
211-
sprintf_item_head(p, va_arg(args, struct item_head *));
233+
p += scnprintf_item_head(p, end - p,
234+
va_arg(args, struct item_head *));
212235
break;
213236
case 't':
214-
sprintf_direntry(p,
215-
va_arg(args,
216-
struct reiserfs_dir_entry *));
237+
p += scnprintf_direntry(p, end - p,
238+
va_arg(args, struct reiserfs_dir_entry *));
217239
break;
218240
case 'y':
219-
sprintf_disk_child(p,
220-
va_arg(args, struct disk_child *));
241+
p += scnprintf_disk_child(p, end - p,
242+
va_arg(args, struct disk_child *));
221243
break;
222244
case 'z':
223-
sprintf_block_head(p,
224-
va_arg(args, struct buffer_head *));
245+
p += scnprintf_block_head(p, end - p,
246+
va_arg(args, struct buffer_head *));
225247
break;
226248
case 'b':
227-
sprintf_buffer_head(p,
228-
va_arg(args, struct buffer_head *));
249+
p += scnprintf_buffer_head(p, end - p,
250+
va_arg(args, struct buffer_head *));
229251
break;
230252
case 'a':
231-
sprintf_de_head(p,
232-
va_arg(args,
233-
struct reiserfs_de_head *));
253+
p += scnprintf_de_head(p, end - p,
254+
va_arg(args, struct reiserfs_de_head *));
234255
break;
235256
}
236257

237-
p += strlen(p);
238258
fmt1 = k + 2;
239259
}
240-
vsprintf(p, fmt1, args);
260+
p += vscnprintf(p, end - p, fmt1, args);
261+
out_unlock:
241262
spin_unlock(&error_lock);
242263

243264
}

‎include/asm-generic/tlb.h

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -265,33 +265,41 @@ static inline void tlb_remove_check_page_size_change(struct mmu_gather *tlb,
265265
* For now w.r.t page table cache, mark the range_size as PAGE_SIZE
266266
*/
267267

268+
#ifndef pte_free_tlb
268269
#define pte_free_tlb(tlb, ptep, address) \
269270
do { \
270271
__tlb_adjust_range(tlb, address, PAGE_SIZE); \
271272
__pte_free_tlb(tlb, ptep, address); \
272273
} while (0)
274+
#endif
273275

276+
#ifndef pmd_free_tlb
274277
#define pmd_free_tlb(tlb, pmdp, address) \
275278
do { \
276279
__tlb_adjust_range(tlb, address, PAGE_SIZE); \
277280
__pmd_free_tlb(tlb, pmdp, address); \
278281
} while (0)
282+
#endif
279283

280284
#ifndef __ARCH_HAS_4LEVEL_HACK
285+
#ifndef pud_free_tlb
281286
#define pud_free_tlb(tlb, pudp, address) \
282287
do { \
283288
__tlb_adjust_range(tlb, address, PAGE_SIZE); \
284289
__pud_free_tlb(tlb, pudp, address); \
285290
} while (0)
286291
#endif
292+
#endif
287293

288294
#ifndef __ARCH_HAS_5LEVEL_HACK
295+
#ifndef p4d_free_tlb
289296
#define p4d_free_tlb(tlb, pudp, address) \
290297
do { \
291298
__tlb_adjust_range(tlb, address, PAGE_SIZE); \
292299
__p4d_free_tlb(tlb, pudp, address); \
293300
} while (0)
294301
#endif
302+
#endif
295303

296304
#define tlb_migrate_finish(mm) do {} while (0)
297305

‎mm/gup.c

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1238,8 +1238,6 @@ int __mm_populate(unsigned long start, unsigned long len, int ignore_errors)
12381238
int locked = 0;
12391239
long ret = 0;
12401240

1241-
VM_BUG_ON(start & ~PAGE_MASK);
1242-
VM_BUG_ON(len != PAGE_ALIGN(len));
12431241
end = start + len;
12441242

12451243
for (nstart = start; nstart < end; nstart = nend) {

‎mm/memblock.c

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -227,7 +227,8 @@ phys_addr_t __init_memblock memblock_find_in_range_node(phys_addr_t size,
227227
* so we use WARN_ONCE() here to see the stack trace if
228228
* fail happens.
229229
*/
230-
WARN_ONCE(1, "memblock: bottom-up allocation failed, memory hotunplug may be affected\n");
230+
WARN_ONCE(IS_ENABLED(CONFIG_MEMORY_HOTREMOVE),
231+
"memblock: bottom-up allocation failed, memory hotremove may be affected\n");
231232
}
232233

233234
return __memblock_find_range_top_down(start, end, size, align, nid,

0 commit comments

Comments
 (0)