The patch titled
Subject: lib/bitmap.c: fix remaining space computation in bitmap_print_to_pagebuf
has been added to the -mm tree. Its filename is
lib-bitmapc-fix-remaining-space-computation-in-bitmap_print_to_pagebuf.patch
This patch should soon appear at
http://ozlabs.org/~akpm/mmots/broken-out/lib-bitmapc-fix-remaining-space-computation-in-bitmap_print_to_pagebuf.patch
and later at
http://ozlabs.org/~akpm/mmotm/broken-out/lib-bitmapc-fix-remaining-space-computation-in-bitmap_print_to_pagebuf.patch
Before you just go and hit "reply", please:
a) Consider who else should be cc'ed
b) Prefer to cc a suitable mailing list as well
c) Ideally: find the original patch on the mailing list and do a
reply-to-all to that, adding suitable additional cc's
*** Remember to use Documentation/process/submit-checklist.rst when testing your code ***
The -mm tree is included into linux-next and is updated
there every 3-4 working days
------------------------------------------------------
From: Rasmus Villemoes <linux@xxxxxxxxxxxxxxxxxx>
Subject: lib/bitmap.c: fix remaining space computation in bitmap_print_to_pagebuf
For various alignments of buf, the current expression computes
4096 ok
4095 ok
8190
8189
...
4097
i.e., if the caller has already written two bytes into the page buffer,
len is 8190 rather than 4094, because PTR_ALIGN aligns up to the next
boundary. So if the printed version of the bitmap is huge, scnprintf()
ends up writing beyond the page boundary.
I don't think any current callers actually write anything before
bitmap_print_to_pagebuf, but the API seems to be designed to allow it.
Link: http://lkml.kernel.org/r/20180818131623.8755-7-linux@xxxxxxxxxxxxxxxxxx
Signed-off-by: Rasmus Villemoes <linux@xxxxxxxxxxxxxxxxxx>
Reviewed-by: Andy Shevchenko <andy.shevchenko@xxxxxxxxx>
Cc: Yury Norov <ynorov@xxxxxxxxxxxxxxxxxx>
Cc: Rasmus Villemoes <linux@xxxxxxxxxxxxxxxxxx>
Cc: Sudeep Holla <sudeep.holla@xxxxxxx>
Signed-off-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx>
---
lib/bitmap.c | 9 +++++----
1 file changed, 5 insertions(+), 4 deletions(-)
--- a/lib/bitmap.c~lib-bitmapc-fix-remaining-space-computation-in-bitmap_print_to_pagebuf
+++ a/lib/bitmap.c
@@ -461,14 +461,15 @@ EXPORT_SYMBOL(bitmap_parse_user);
* ranges if list is specified or hex digits grouped into comma-separated
* sets of 8 digits/set. Returns the number of characters written to buf.
*
- * It is assumed that @buf is a pointer into a PAGE_SIZE area and that
- * sufficient storage remains at @buf to accommodate the
- * bitmap_print_to_pagebuf() output.
+ * It is assumed that @buf is a pointer into a PAGE_SIZE, page-aligned
+ * area and that sufficient storage remains at @buf to accommodate the
+ * bitmap_print_to_pagebuf() output. Returns the number of characters
+ * actually printed to @buf, excluding terminating '\0'.
*/
int bitmap_print_to_pagebuf(bool list, char *buf, const unsigned long *maskp,
int nmaskbits)
{
- ptrdiff_t len = PTR_ALIGN(buf + PAGE_SIZE - 1, PAGE_SIZE) - buf;
+ ptrdiff_t len = PAGE_SIZE - ((unsigned long)buf & (PAGE_SIZE-1));
int n = 0;
if (len > 1)
_
Patches currently in -mm which might be from linux@xxxxxxxxxxxxxxxxxx are
lib-bitmapc-remove-wrong-documentation.patch
linux-bitmaph-handle-constant-zero-size-bitmaps-correctly.patch
linux-bitmaph-remove-redundant-uses-of-small_const_nbits.patch
linux-bitmaph-fix-type-of-nbits-in-bitmap_shift_right.patch
linux-bitmaph-relax-comment-on-compile-time-constant-nbits.patch
lib-bitmapc-fix-remaining-space-computation-in-bitmap_print_to_pagebuf.patch
lib-bitmapc-simplify-bitmap_print_to_pagebuf.patch
