The patch titled KSYM_SYMBOL_LEN fixes has been added to the -mm tree. Its filename is ksym_symbol_len-fixes.patch Before you just go and hit "reply", please: a) Consider who else should be cc'ed b) Prefer to cc a suitable mailing list as well c) Ideally: find the original patch on the mailing list and do a reply-to-all to that, adding suitable additional cc's *** Remember to use Documentation/SubmitChecklist when testing your code *** See http://userweb.kernel.org/~akpm/stuff/added-to-mm.txt to find out what to do about this The current -mm tree may be found at http://userweb.kernel.org/~akpm/mmotm/ ------------------------------------------------------ Subject: KSYM_SYMBOL_LEN fixes From: Hugh Dickins <hugh@xxxxxxxxxxx> Miles Lane tailing /sys files hit a BUG which Pekka Enberg has tracked to my 966c8c12dc9e77f931e2281ba25d2f0244b06949 sprint_symbol(): use less stack exposing a bug in slub's list_locations() - kallsyms_lookup() writes a 0 to namebuf[KSYM_NAME_LEN-1], but that was beyond the end of page provided. The 100 slop which list_locations() allows at end of page looks roughly enough for all the other stuff it might print after the symbol before it checks again: break out KSYM_SYMBOL_LEN earlier than before. Latencytop and ftrace and are using KSYM_NAME_LEN buffers where they need KSYM_SYMBOL_LEN buffers, and vmallocinfo a 2*KSYM_NAME_LEN buffer where it wants a KSYM_SYMBOL_LEN buffer: fix those before anyone copies them. Signed-off-by: Hugh Dickins <hugh@xxxxxxxxxxx> Cc: Christoph Lameter <cl@xxxxxxxxxxxxxxxxxxxx> Cc Miles Lane <miles.lane@xxxxxxxxx> Acked-by: Pekka Enberg <penberg@xxxxxxxxxxxxxx> Acked-by: Steven Rostedt <srostedt@xxxxxxxxxx> Acked-by: Frederic Weisbecker <fweisbec@xxxxxxxxx> Signed-off-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx> --- fs/proc/base.c | 2 +- include/linux/ftrace.h | 2 +- kernel/latencytop.c | 2 +- mm/slub.c | 2 +- mm/vmalloc.c | 2 +- 5 files changed, 5 insertions(+), 5 deletions(-) diff -puN fs/proc/base.c~ksym_symbol_len-fixes fs/proc/base.c --- a/fs/proc/base.c~ksym_symbol_len-fixes +++ a/fs/proc/base.c @@ -371,7 +371,7 @@ static int lstats_show_proc(struct seq_f task->latency_record[i].time, task->latency_record[i].max); for (q = 0; q < LT_BACKTRACEDEPTH; q++) { - char sym[KSYM_NAME_LEN]; + char sym[KSYM_SYMBOL_LEN]; char *c; if (!task->latency_record[i].backtrace[q]) break; diff -puN include/linux/ftrace.h~ksym_symbol_len-fixes include/linux/ftrace.h --- a/include/linux/ftrace.h~ksym_symbol_len-fixes +++ a/include/linux/ftrace.h @@ -231,7 +231,7 @@ ftrace_init_module(unsigned long *start, struct boot_trace { pid_t caller; - char func[KSYM_NAME_LEN]; + char func[KSYM_SYMBOL_LEN]; int result; unsigned long long duration; /* usecs */ ktime_t calltime; diff -puN kernel/latencytop.c~ksym_symbol_len-fixes kernel/latencytop.c --- a/kernel/latencytop.c~ksym_symbol_len-fixes +++ a/kernel/latencytop.c @@ -191,7 +191,7 @@ static int lstats_show(struct seq_file * latency_record[i].time, latency_record[i].max); for (q = 0; q < LT_BACKTRACEDEPTH; q++) { - char sym[KSYM_NAME_LEN]; + char sym[KSYM_SYMBOL_LEN]; char *c; if (!latency_record[i].backtrace[q]) break; diff -puN mm/slub.c~ksym_symbol_len-fixes mm/slub.c --- a/mm/slub.c~ksym_symbol_len-fixes +++ a/mm/slub.c @@ -3597,7 +3597,7 @@ static int list_locations(struct kmem_ca for (i = 0; i < t.count; i++) { struct location *l = &t.loc[i]; - if (len > PAGE_SIZE - 100) + if (len > PAGE_SIZE - KSYM_SYMBOL_LEN - 100) break; len += sprintf(buf + len, "%7ld ", l->count); diff -puN mm/vmalloc.c~ksym_symbol_len-fixes mm/vmalloc.c --- a/mm/vmalloc.c~ksym_symbol_len-fixes +++ a/mm/vmalloc.c @@ -1717,7 +1717,7 @@ static int s_show(struct seq_file *m, vo v->addr, v->addr + v->size, v->size); if (v->caller) { - char buff[2 * KSYM_NAME_LEN]; + char buff[KSYM_SYMBOL_LEN]; seq_putc(m, ' '); sprint_symbol(buff, (unsigned long)v->caller); _ Patches currently in -mm which might be from hugh@xxxxxxxxxxx are ksym_symbol_len-fixes.patch linux-next.patch mm-dont-mark_page_accessed-in-shmem_fault.patch mm-apply_to_range-call-pte-function-with-lazy-updates.patch mm-remove-cgroup_mm_owner_callbacks.patch mm-remove-aop_writepage_activate.patch mm-remove-gfp_highuser_pagecache.patch mm-add-setclearpageswapcache-stubs.patch mm-replace-some-bug_ons-by-vm_bug_ons.patch mm-add_active_or_unevictable-into-rmap.patch mm-make-page_lock_anon_vma-static.patch mm-further-cleanup-page_add_new_anon_rmap.patch mm-gup-persist-for-write-permission.patch mm-wp-lock-page-before-deciding-cow.patch mm-reuse_swap_page-replaces-can_share_swap_page.patch mm-try_to_free_swap-replaces-remove_exclusive_swap_page.patch mm-try_to_unuse-check-removing-right-swap.patch mm-remove-try_to_munlock-from-vmscan.patch mm-remove-gfp_mask-from-add_to_swap.patch mm-add-add_to_swap-stub.patch mm-optimize-get_scan_ratio-for-no-swap.patch make-get_user_pages-interruptible.patch make-get_user_pages-interruptible-update.patch swapfile-swapon-needs-larger-size-type.patch swapfile-remove-swp_active-mask.patch swapfile-remove-surplus-whitespace.patch swapfile-remove-v0-swap-space-message.patch swapfile-rearrange-scan-and-swap_info.patch swapfile-swapon-use-discard-trim.patch swapfile-swap-allocation-use-discard.patch swapfile-swapon-randomize-if-nonrot.patch swapfile-swap-allocation-cycle-if-nonrot.patch memcg-handle-swap-caches.patch memcg-handle-swap-caches-build-fix.patch memcg-swap-cgroup-for-remembering-usage.patch memcg-memswap-controller-core.patch memcg-memswap-controller-core-make-resize-limit-hold-mutex.patch memcg-memswap-controller-core-swapcache-fixes.patch prio_tree-debugging-patch.patch -- To unsubscribe from this list: send the line "unsubscribe mm-commits" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html