From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-10.1 required=3.0 tests=DKIMWL_WL_HIGH,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,INCLUDES_PATCH,MAILING_LIST_MULTI,SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 5FB69C432C3 for ; Sat, 16 Nov 2019 15:45:06 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 3154920740 for ; Sat, 16 Nov 2019 15:45:06 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1573919106; bh=qgKnA8ercINp8dTih9WIGTCvC7aWFs7CarrmJcobrQ0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=oFNHWFHQbQJLXq0k8bJOPIVnhSyZRwleT5gLRIMxIqAVeKc8qVtZk3vzkA8yFzTj4 5yu/7tF4SBg3D7OaLrKJOTKD+EASfZ+QjUTlFEROd3wDB7Vim5OKvIGvTpzB0Xvlv0 E0hwzCjHOiAgE8/9UudCM8DppEWqXIVLmscm9xY4= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1729119AbfKPPpD (ORCPT ); Sat, 16 Nov 2019 10:45:03 -0500 Received: from mail.kernel.org ([198.145.29.99]:50116 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1729095AbfKPPo4 (ORCPT ); Sat, 16 Nov 2019 10:44:56 -0500 Received: from sasha-vm.mshome.net (unknown [50.234.116.4]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 1D8B92075B; Sat, 16 Nov 2019 15:44:55 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1573919095; bh=qgKnA8ercINp8dTih9WIGTCvC7aWFs7CarrmJcobrQ0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=i7CfAuj02QQ3h2/y7m6KvD3okRqSm7qkDBtidWjxlP7S2XdsXIUxZet5xOL8deu23 PnBaO3kCCZinzvAZSi20AFwO0mHzYMKDX57T6Ga6MKa8wSvXYrEkpAPvblOqaaC8AB lJE3NHoQweF8EBDj5NogAf5PjnqRA7CGrkIaBUEk= From: Sasha Levin To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: Rasmus Villemoes , Andy Shevchenko , Yury Norov , Sudeep Holla , Andrew Morton , Linus Torvalds , Sasha Levin Subject: [PATCH AUTOSEL 4.19 152/237] lib/bitmap.c: fix remaining space computation in bitmap_print_to_pagebuf Date: Sat, 16 Nov 2019 10:39:47 -0500 Message-Id: <20191116154113.7417-152-sashal@kernel.org> X-Mailer: git-send-email 2.20.1 In-Reply-To: <20191116154113.7417-1-sashal@kernel.org> References: <20191116154113.7417-1-sashal@kernel.org> MIME-Version: 1.0 X-stable: review X-Patchwork-Hint: Ignore Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Rasmus Villemoes [ Upstream commit ce1091d471107dbf6f91db66a480a25950c9b9ff ] For various alignments of buf, the current expression computes 4096 ok 4095 ok 8190 8189 ... 4097 i.e., if the caller has already written two bytes into the page buffer, len is 8190 rather than 4094, because PTR_ALIGN aligns up to the next boundary. So if the printed version of the bitmap is huge, scnprintf() ends up writing beyond the page boundary. I don't think any current callers actually write anything before bitmap_print_to_pagebuf, but the API seems to be designed to allow it. [akpm@linux-foundation.org: use offset_in_page(), per Andy] [akpm@linux-foundation.org: include mm.h for offset_in_page()] Link: http://lkml.kernel.org/r/20180818131623.8755-7-linux@rasmusvillemoes.dk Signed-off-by: Rasmus Villemoes Reviewed-by: Andy Shevchenko Cc: Yury Norov Cc: Rasmus Villemoes Cc: Sudeep Holla Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Sasha Levin --- lib/bitmap.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/lib/bitmap.c b/lib/bitmap.c index 2fd07f6df0b85..c4ca9ceb09fe3 100644 --- a/lib/bitmap.c +++ b/lib/bitmap.c @@ -13,6 +13,7 @@ #include #include #include +#include #include #include #include @@ -466,14 +467,15 @@ EXPORT_SYMBOL(bitmap_parse_user); * ranges if list is specified or hex digits grouped into comma-separated * sets of 8 digits/set. Returns the number of characters written to buf. * - * It is assumed that @buf is a pointer into a PAGE_SIZE area and that - * sufficient storage remains at @buf to accommodate the - * bitmap_print_to_pagebuf() output. + * It is assumed that @buf is a pointer into a PAGE_SIZE, page-aligned + * area and that sufficient storage remains at @buf to accommodate the + * bitmap_print_to_pagebuf() output. Returns the number of characters + * actually printed to @buf, excluding terminating '\0'. */ int bitmap_print_to_pagebuf(bool list, char *buf, const unsigned long *maskp, int nmaskbits) { - ptrdiff_t len = PTR_ALIGN(buf + PAGE_SIZE - 1, PAGE_SIZE) - buf; + ptrdiff_t len = PAGE_SIZE - offset_in_page(buf); int n = 0; if (len > 1) -- 2.20.1