]> git.proxmox.com Git - mirror_ubuntu-bionic-kernel.git/commit
lib/bitmap.c: fix remaining space computation in bitmap_print_to_pagebuf
authorRasmus Villemoes <linux@rasmusvillemoes.dk>
Tue, 30 Oct 2018 22:05:14 +0000 (15:05 -0700)
committerMarcelo Henrique Cerri <marcelo.cerri@canonical.com>
Fri, 17 Jan 2020 17:21:17 +0000 (14:21 -0300)
commite9983f65d424a83838c1361a2c63b406e22ed293
tree646fd22e0561e510394f8f140a03ff3ec8e09db8
parent15e01792cd4668fd291194fc43039c0e4f840b7e
lib/bitmap.c: fix remaining space computation in bitmap_print_to_pagebuf

BugLink: https://bugs.launchpad.net/bugs/1854975
[ Upstream commit ce1091d471107dbf6f91db66a480a25950c9b9ff ]

For various alignments of buf, the current expression computes

4096 ok
4095 ok
8190
8189
...
4097

i.e., if the caller has already written two bytes into the page buffer,
len is 8190 rather than 4094, because PTR_ALIGN aligns up to the next
boundary.  So if the printed version of the bitmap is huge, scnprintf()
ends up writing beyond the page boundary.

I don't think any current callers actually write anything before
bitmap_print_to_pagebuf, but the API seems to be designed to allow it.

[akpm@linux-foundation.org: use offset_in_page(), per Andy]
[akpm@linux-foundation.org: include mm.h for offset_in_page()]
Link: http://lkml.kernel.org/r/20180818131623.8755-7-linux@rasmusvillemoes.dk
Signed-off-by: Rasmus Villemoes <linux@rasmusvillemoes.dk>
Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>
Cc: Yury Norov <ynorov@caviumnetworks.com>
Cc: Rasmus Villemoes <linux@rasmusvillemoes.dk>
Cc: Sudeep Holla <sudeep.holla@arm.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
Signed-off-by: Kleber Sacilotto de Souza <kleber.souza@canonical.com>
lib/bitmap.c