Commit f353078f authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge branch 'akpm' (patches from Andrew) 

Merge misc fixes from Andrew Morton:
 "11 fixes"

* emailed patches form Andrew Morton <akpm@linux-foundation.org>:
  reiserfs: fix buffer overflow with long warning messages
  checkpatch: fix duplicate invalid vsprintf pointer extension '%p<foo>' messages
  mm: do not bug_on on incorrect length in __mm_populate()
  mm/memblock.c: do not complain about top-down allocations for !MEMORY_HOTREMOVE
  fs, elf: make sure to page align bss in load_elf_library
  x86/purgatory: add missing FORCE to Makefile target
  net/9p/client.c: put refcount of trans_mod in error case in parse_opts()
  mm: allow arch to supply p??_free_tlb functions
  autofs: fix slab out of bounds read in getname_kernel()
  fs/proc/task_mmu.c: fix Locked field in /proc/pid/smaps*
  mm: do not drop unused pages when userfaultd is running
parents e181ae0c fe10e398

arch/x86/purgatory/Makefile

+1 −1
Original line number Diff line number Diff line
@@ -6,7 +6,7 @@ purgatory-y := purgatory.o stack.o setup-x86_$(BITS).o sha256.o entry64.o string 
targets += $(purgatory-y)

PURGATORY_OBJS = $(addprefix $(obj)/,$(purgatory-y))



$(obj)/sha256.o: $(srctree)/lib/sha256.c

$(obj)/sha256.o: $(srctree)/lib/sha256.c FORCE

	$(call if_changed_rule,cc_o_c)



LDFLAGS_purgatory.ro := -e purgatory_start -r --no-undefined -nostdlib -z nodefaultlib

fs/autofs/dev-ioctl.c

+13 −9
Original line number Diff line number Diff line
@@ -135,6 +135,15 @@ static int validate_dev_ioctl(int cmd, struct autofs_dev_ioctl *param) 
				cmd);

			goto out;

		}

	} else {

		unsigned int inr = _IOC_NR(cmd);



		if (inr == AUTOFS_DEV_IOCTL_OPENMOUNT_CMD ||

		    inr == AUTOFS_DEV_IOCTL_REQUESTER_CMD ||

		    inr == AUTOFS_DEV_IOCTL_ISMOUNTPOINT_CMD) {

			err = -EINVAL;

			goto out;

		}

	}



	err = 0;
@@ -271,7 +280,8 @@ static int autofs_dev_ioctl_openmount(struct file *fp, 
	dev_t devid;

	int err, fd;



	/* param->path has already been checked */

	/* param->path has been checked in validate_dev_ioctl() */



	if (!param->openmount.devid)

		return -EINVAL;
@@ -433,10 +443,7 @@ static int autofs_dev_ioctl_requester(struct file *fp, 
	dev_t devid;

	int err = -ENOENT;



	if (param->size <= AUTOFS_DEV_IOCTL_SIZE) {

		err = -EINVAL;

		goto out;

	}

	/* param->path has been checked in validate_dev_ioctl() */



	devid = sbi->sb->s_dev;
@@ -521,10 +528,7 @@ static int autofs_dev_ioctl_ismountpoint(struct file *fp, 
	unsigned int devid, magic;

	int err = -ENOENT;



	if (param->size <= AUTOFS_DEV_IOCTL_SIZE) {

		err = -EINVAL;

		goto out;

	}

	/* param->path has been checked in validate_dev_ioctl() */



	name = param->path;

	type = param->ismountpoint.in.type;

fs/binfmt_elf.c

+2 −3
Original line number Diff line number Diff line
@@ -1259,9 +1259,8 @@ static int load_elf_library(struct file *file) 
		goto out_free_ph;

	}



	len = ELF_PAGESTART(eppnt->p_filesz + eppnt->p_vaddr +

			    ELF_MIN_ALIGN - 1);

	bss = eppnt->p_memsz + eppnt->p_vaddr;

	len = ELF_PAGEALIGN(eppnt->p_filesz + eppnt->p_vaddr);

	bss = ELF_PAGEALIGN(eppnt->p_memsz + eppnt->p_vaddr);

	if (bss > len) {

		error = vm_brk(len, bss - len);

		if (error)

fs/proc/task_mmu.c

+2 −1
Original line number Diff line number Diff line
@@ -831,7 +831,8 @@ static int show_smap(struct seq_file *m, void *v, int is_pid) 
		SEQ_PUT_DEC(" kB\nSwap:           ", mss->swap);

		SEQ_PUT_DEC(" kB\nSwapPss:        ",

						mss->swap_pss >> PSS_SHIFT);

		SEQ_PUT_DEC(" kB\nLocked:         ", mss->pss >> PSS_SHIFT);

		SEQ_PUT_DEC(" kB\nLocked:         ",

						mss->pss_locked >> PSS_SHIFT);

		seq_puts(m, " kB\n");

	}

	if (!rollup_mode) {

fs/reiserfs/prints.c

+81 −60
Original line number Diff line number Diff line
@@ -76,83 +76,99 @@ static char *le_type(struct reiserfs_key *key) 
}



/* %k */

static void sprintf_le_key(char *buf, struct reiserfs_key *key)

static int scnprintf_le_key(char *buf, size_t size, struct reiserfs_key *key)

{

	if (key)

		sprintf(buf, "[%d %d %s %s]", le32_to_cpu(key->k_dir_id),

		return scnprintf(buf, size, "[%d %d %s %s]",

				 le32_to_cpu(key->k_dir_id),

				 le32_to_cpu(key->k_objectid), le_offset(key),

				 le_type(key));

	else

		sprintf(buf, "[NULL]");

		return scnprintf(buf, size, "[NULL]");

}



/* %K */

static void sprintf_cpu_key(char *buf, struct cpu_key *key)

static int scnprintf_cpu_key(char *buf, size_t size, struct cpu_key *key)

{

	if (key)

		sprintf(buf, "[%d %d %s %s]", key->on_disk_key.k_dir_id,

			key->on_disk_key.k_objectid, reiserfs_cpu_offset(key),

			cpu_type(key));

		return scnprintf(buf, size, "[%d %d %s %s]",

				 key->on_disk_key.k_dir_id,

				 key->on_disk_key.k_objectid,

				 reiserfs_cpu_offset(key), cpu_type(key));

	else

		sprintf(buf, "[NULL]");

		return scnprintf(buf, size, "[NULL]");

}



static void sprintf_de_head(char *buf, struct reiserfs_de_head *deh)

static int scnprintf_de_head(char *buf, size_t size,

			     struct reiserfs_de_head *deh)

{

	if (deh)

		sprintf(buf,

		return scnprintf(buf, size,

				 "[offset=%d dir_id=%d objectid=%d location=%d state=%04x]",

			deh_offset(deh), deh_dir_id(deh), deh_objectid(deh),

			deh_location(deh), deh_state(deh));

				 deh_offset(deh), deh_dir_id(deh),

				 deh_objectid(deh), deh_location(deh),

				 deh_state(deh));

	else

		sprintf(buf, "[NULL]");

		return scnprintf(buf, size, "[NULL]");



}



static void sprintf_item_head(char *buf, struct item_head *ih)

static int scnprintf_item_head(char *buf, size_t size, struct item_head *ih)

{

	if (ih) {

		strcpy(buf,

		       (ih_version(ih) == KEY_FORMAT_3_6) ? "*3.6* " : "*3.5*");

		sprintf_le_key(buf + strlen(buf), &(ih->ih_key));

		sprintf(buf + strlen(buf), ", item_len %d, item_location %d, "

			"free_space(entry_count) %d",

			ih_item_len(ih), ih_location(ih), ih_free_space(ih));

		char *p = buf;

		char * const end = buf + size;



		p += scnprintf(p, end - p, "%s",

			       (ih_version(ih) == KEY_FORMAT_3_6) ?

			       "*3.6* " : "*3.5*");



		p += scnprintf_le_key(p, end - p, &ih->ih_key);



		p += scnprintf(p, end - p,

			       ", item_len %d, item_location %d, free_space(entry_count) %d",

			       ih_item_len(ih), ih_location(ih),

			       ih_free_space(ih));

		return p - buf;

	} else

		sprintf(buf, "[NULL]");

		return scnprintf(buf, size, "[NULL]");

}



static void sprintf_direntry(char *buf, struct reiserfs_dir_entry *de)

static int scnprintf_direntry(char *buf, size_t size,

			      struct reiserfs_dir_entry *de)

{

	char name[20];



	memcpy(name, de->de_name, de->de_namelen > 19 ? 19 : de->de_namelen);

	name[de->de_namelen > 19 ? 19 : de->de_namelen] = 0;

	sprintf(buf, "\"%s\"==>[%d %d]", name, de->de_dir_id, de->de_objectid);

	return scnprintf(buf, size, "\"%s\"==>[%d %d]",

			 name, de->de_dir_id, de->de_objectid);

}



static void sprintf_block_head(char *buf, struct buffer_head *bh)

static int scnprintf_block_head(char *buf, size_t size, struct buffer_head *bh)

{

	sprintf(buf, "level=%d, nr_items=%d, free_space=%d rdkey ",

	return scnprintf(buf, size,

			 "level=%d, nr_items=%d, free_space=%d rdkey ",

			 B_LEVEL(bh), B_NR_ITEMS(bh), B_FREE_SPACE(bh));

}



static void sprintf_buffer_head(char *buf, struct buffer_head *bh)

static int scnprintf_buffer_head(char *buf, size_t size, struct buffer_head *bh)

{

	sprintf(buf,

	return scnprintf(buf, size,

			 "dev %pg, size %zd, blocknr %llu, count %d, state 0x%lx, page %p, (%s, %s, %s)",

			 bh->b_bdev, bh->b_size,

		(unsigned long long)bh->b_blocknr, atomic_read(&(bh->b_count)),

			 (unsigned long long)bh->b_blocknr,

			 atomic_read(&(bh->b_count)),

			 bh->b_state, bh->b_page,

			 buffer_uptodate(bh) ? "UPTODATE" : "!UPTODATE",

			 buffer_dirty(bh) ? "DIRTY" : "CLEAN",

			 buffer_locked(bh) ? "LOCKED" : "UNLOCKED");

}



static void sprintf_disk_child(char *buf, struct disk_child *dc)

static int scnprintf_disk_child(char *buf, size_t size, struct disk_child *dc)

{

	sprintf(buf, "[dc_number=%d, dc_size=%u]", dc_block_number(dc),

		dc_size(dc));

	return scnprintf(buf, size, "[dc_number=%d, dc_size=%u]",

			 dc_block_number(dc), dc_size(dc));

}



static char *is_there_reiserfs_struct(char *fmt, int *what)
@@ -189,55 +205,60 @@ static void prepare_error_buf(const char *fmt, va_list args) 
	char *fmt1 = fmt_buf;

	char *k;

	char *p = error_buf;

	char * const end = &error_buf[sizeof(error_buf)];

	int what;



	spin_lock(&error_lock);



	strcpy(fmt1, fmt);

	if (WARN_ON(strscpy(fmt_buf, fmt, sizeof(fmt_buf)) < 0)) {

		strscpy(error_buf, "format string too long", end - error_buf);

		goto out_unlock;

	}



	while ((k = is_there_reiserfs_struct(fmt1, &what)) != NULL) {

		*k = 0;



		p += vsprintf(p, fmt1, args);

		p += vscnprintf(p, end - p, fmt1, args);



		switch (what) {

		case 'k':

			sprintf_le_key(p, va_arg(args, struct reiserfs_key *));

			p += scnprintf_le_key(p, end - p,

					      va_arg(args, struct reiserfs_key *));

			break;

		case 'K':

			sprintf_cpu_key(p, va_arg(args, struct cpu_key *));

			p += scnprintf_cpu_key(p, end - p,

					       va_arg(args, struct cpu_key *));

			break;

		case 'h':

			sprintf_item_head(p, va_arg(args, struct item_head *));

			p += scnprintf_item_head(p, end - p,

						 va_arg(args, struct item_head *));

			break;

		case 't':

			sprintf_direntry(p,

					 va_arg(args,

						struct reiserfs_dir_entry *));

			p += scnprintf_direntry(p, end - p,

						va_arg(args, struct reiserfs_dir_entry *));

			break;

		case 'y':

			sprintf_disk_child(p,

			p += scnprintf_disk_child(p, end - p,

						  va_arg(args, struct disk_child *));

			break;

		case 'z':

			sprintf_block_head(p,

			p += scnprintf_block_head(p, end - p,

						  va_arg(args, struct buffer_head *));

			break;

		case 'b':

			sprintf_buffer_head(p,

			p += scnprintf_buffer_head(p, end - p,

						   va_arg(args, struct buffer_head *));

			break;

		case 'a':

			sprintf_de_head(p,

					va_arg(args,

					       struct reiserfs_de_head *));

			p += scnprintf_de_head(p, end - p,

					       va_arg(args, struct reiserfs_de_head *));

			break;

		}



		p += strlen(p);

		fmt1 = k + 2;

	}

	vsprintf(p, fmt1, args);

	p += vscnprintf(p, end - p, fmt1, args);

out_unlock:

	spin_unlock(&error_lock);



}

CRA Git | Maintained and supported by SUSTech CRA and CCSE