From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753183AbbLFAln (ORCPT ); Sat, 5 Dec 2015 19:41:43 -0500 Received: from mail-lf0-f43.google.com ([209.85.215.43]:32827 "EHLO mail-lf0-f43.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752669AbbLFAlm (ORCPT ); Sat, 5 Dec 2015 19:41:42 -0500 From: Rasmus Villemoes To: Oleg Drokin , Andreas Dilger , Greg Kroah-Hartman Cc: Rasmus Villemoes , lustre-devel@lists.lustre.org, devel@driverdev.osuosl.org, linux-kernel@vger.kernel.org Subject: [PATCH] staging: lustre: fix %.2X versus signed char issue Date: Sun, 6 Dec 2015 01:41:31 +0100 Message-Id: <1449362492-20779-1-git-send-email-linux@rasmusvillemoes.dk> X-Mailer: git-send-email 2.6.1 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org When char is signed and one of the bytes in lmm happens to have a byte value above 127, the result of printing that with %.2X will be 8 hex chars, the first 6 of which are 'F'. Worst case, we'll overrun our 'carefully' allocated buffer. I didn't have the tenacity to work through the gazillion and seven layers of macros behind CERROR, but I assume it'll all end at some function implemented in terms of the kernel's vsnprintf. Use %*phN for a hexdump. That'll cap the number of dumped bytes at 64. If that's a problem, the loop could be replaced by "bin2hex(buffer, lmm, lmm_bytes);". Signed-off-by: Rasmus Villemoes --- drivers/staging/lustre/lustre/lov/lov_pack.c | 15 +-------------- 1 file changed, 1 insertion(+), 14 deletions(-) diff --git a/drivers/staging/lustre/lustre/lov/lov_pack.c b/drivers/staging/lustre/lustre/lov/lov_pack.c index 2fb1e974cc70..7f18d08929a5 100644 --- a/drivers/staging/lustre/lustre/lov/lov_pack.c +++ b/drivers/staging/lustre/lustre/lov/lov_pack.c @@ -258,22 +258,9 @@ static int lov_verify_lmm(void *lmm, int lmm_bytes, __u16 *stripe_count) int rc; if (lsm_op_find(le32_to_cpu(*(__u32 *)lmm)) == NULL) { - char *buffer; - int sz; - CERROR("bad disk LOV MAGIC: 0x%08X; dumping LMM (size=%d):\n", le32_to_cpu(*(__u32 *)lmm), lmm_bytes); - sz = lmm_bytes * 2 + 1; - buffer = libcfs_kvzalloc(sz, GFP_NOFS); - if (buffer != NULL) { - int i; - - for (i = 0; i < lmm_bytes; i++) - sprintf(buffer+2*i, "%.2X", ((char *)lmm)[i]); - buffer[sz - 1] = '\0'; - CERROR("%s\n", buffer); - kvfree(buffer); - } + CERROR("%*phN\n", lmm_bytes, lmm); return -EINVAL; } rc = lsm_op_find(le32_to_cpu(*(__u32 *)lmm))->lsm_lmm_verify(lmm, -- 2.6.1