diff options
| author | Rasmus Villemoes <linux@rasmusvillemoes.dk> | 2015-12-06 03:41:31 +0300 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2015-12-22 02:46:07 +0300 |
| commit | 20b0236628a8a420bfbf8a3d39576e2ed606fce7 (patch) | |
| tree | d5a794965057a929b03b257e5fd9470ecaca25fa | |
| parent | f916774259d60e8ecd2cdd90e712e4c2fc64b947 (diff) | |
| download | linux-20b0236628a8a420bfbf8a3d39576e2ed606fce7.tar.xz | |
staging: lustre: fix %.2X versus signed char issue
When char is signed and one of the bytes in lmm happens to have a byte
value above 127, the result of printing that with %.2X will be 8 hex
chars, the first 6 of which are 'F'. Worst case, we'll overrun our
'carefully' allocated buffer.
I didn't have the tenacity to work through the gazillion and seven
layers of macros behind CERROR, but I assume it'll all end at some
function implemented in terms of the kernel's vsnprintf. Use %*phN for
a hexdump. That'll cap the number of dumped bytes at 64. If that's a
problem, the loop could be replaced by "bin2hex(buffer, lmm,
lmm_bytes);".
Signed-off-by: Rasmus Villemoes <linux@rasmusvillemoes.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| -rw-r--r-- | drivers/staging/lustre/lustre/lov/lov_pack.c | 15 |
1 files changed, 1 insertions, 14 deletions
diff --git a/drivers/staging/lustre/lustre/lov/lov_pack.c b/drivers/staging/lustre/lustre/lov/lov_pack.c index 198523139b3b..6b2d1007192b 100644 --- a/drivers/staging/lustre/lustre/lov/lov_pack.c +++ b/drivers/staging/lustre/lustre/lov/lov_pack.c @@ -258,22 +258,9 @@ static int lov_verify_lmm(void *lmm, int lmm_bytes, __u16 *stripe_count) int rc; if (lsm_op_find(le32_to_cpu(*(__u32 *)lmm)) == NULL) { - char *buffer; - int sz; - CERROR("bad disk LOV MAGIC: 0x%08X; dumping LMM (size=%d):\n", le32_to_cpu(*(__u32 *)lmm), lmm_bytes); - sz = lmm_bytes * 2 + 1; - buffer = libcfs_kvzalloc(sz, GFP_NOFS); - if (buffer != NULL) { - int i; - - for (i = 0; i < lmm_bytes; i++) - sprintf(buffer+2*i, "%.2X", ((char *)lmm)[i]); - buffer[sz - 1] = '\0'; - CERROR("%s\n", buffer); - kvfree(buffer); - } + CERROR("%*phN\n", lmm_bytes, lmm); return -EINVAL; } rc = lsm_op_find(le32_to_cpu(*(__u32 *)lmm))->lsm_lmm_verify(lmm, |