Subject: [merged] kernel-kexecc-use-vscnprintf-instead-of-vsnprintf-in-vmcoreinfo_append_str.patch removed from -mm tree To: gang.chen@xxxxxxxxxxx,mm-commits@xxxxxxxxxxxxxxx From: akpm@xxxxxxxxxxxxxxxxxxxx Date: Tue, 28 Jan 2014 11:09:47 -0800 The patch titled Subject: kernel/kexec.c: use vscnprintf() instead of vsnprintf() in vmcoreinfo_append_str() has been removed from the -mm tree. Its filename was kernel-kexecc-use-vscnprintf-instead-of-vsnprintf-in-vmcoreinfo_append_str.patch This patch was dropped because it was merged into mainline or a subsystem tree ------------------------------------------------------ From: Chen Gang <gang.chen@xxxxxxxxxxx> Subject: kernel/kexec.c: use vscnprintf() instead of vsnprintf() in vmcoreinfo_append_str() vsnprintf() may let 'r' larger than sizeof(buf), in this case, if 'r' is also less than "vmcoreinfo_max_size - vmcoreinfo_size" (left size of destination buffer), next memcpy() will read the unexpected addresses. Signed-off-by: Chen Gang <gang.chen@xxxxxxxxxxx> Signed-off-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx> --- kernel/kexec.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff -puN kernel/kexec.c~kernel-kexecc-use-vscnprintf-instead-of-vsnprintf-in-vmcoreinfo_append_str kernel/kexec.c --- a/kernel/kexec.c~kernel-kexecc-use-vscnprintf-instead-of-vsnprintf-in-vmcoreinfo_append_str +++ a/kernel/kexec.c @@ -1537,7 +1537,7 @@ void vmcoreinfo_append_str(const char *f size_t r; va_start(args, fmt); - r = vsnprintf(buf, sizeof(buf), fmt, args); + r = vscnprintf(buf, sizeof(buf), fmt, args); va_end(args); r = min(r, vmcoreinfo_max_size - vmcoreinfo_size); _ Patches currently in -mm which might be from gang.chen@xxxxxxxxxxx are origin.patch linux-next.patch -- To unsubscribe from this list: send the line "unsubscribe mm-commits" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html