Revision da094e42848e3c36feaa3b5271e53983fd45424f authored by Prakash Gupta on 18 August 2017, 22:16:21 UTC, committed by Linus Torvalds on 18 August 2017, 22:32:02 UTC
name[] in cma_debugfs_add_one() can only accommodate 16 chars including
NULL to store sprintf output. It's common for cma device name to be
larger than 15 chars. This can cause stack corrpution. If the gcc
stack protector is turned on, this can cause a panic due to stack
corruption.
Below is one example trace:
Kernel panic - not syncing: stack-protector: Kernel stack is corrupted in:
ffffff8e69a75730
Call trace:
dump_backtrace+0x0/0x2c4
show_stack+0x20/0x28
dump_stack+0xb8/0xf4
panic+0x154/0x2b0
print_tainted+0x0/0xc0
cma_debugfs_init+0x274/0x290
do_one_initcall+0x5c/0x168
kernel_init_freeable+0x1c8/0x280
Fix the short sprintf buffer in cma_debugfs_add_one() by using
scnprintf() instead of sprintf().
Link: http://lkml.kernel.org/r/1502446217-21840-1-git-send-email-guptap@codeaurora.org
Fixes: f318dd083c81 ("cma: Store a name in the cma structure")
Signed-off-by: Prakash Gupta <guptap@codeaurora.org>
Acked-by: Laura Abbott <labbott@redhat.com>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
1 parent eb61b59
serial_pnx8xxx.h
/*
* Embedded Alley Solutions, source@embeddedalley.com.
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation; either version 2 of the License, or
* (at your option) any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with this program; if not, write to the Free Software
* Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
*/
#ifndef _LINUX_SERIAL_PNX8XXX_H
#define _LINUX_SERIAL_PNX8XXX_H
#include <linux/serial_core.h>
#define PNX8XXX_NR_PORTS 2
struct pnx8xxx_port {
struct uart_port port;
struct timer_list timer;
unsigned int old_status;
};
/* register offsets */
#define PNX8XXX_LCR 0
#define PNX8XXX_MCR 0x004
#define PNX8XXX_BAUD 0x008
#define PNX8XXX_CFG 0x00c
#define PNX8XXX_FIFO 0x028
#define PNX8XXX_ISTAT 0xfe0
#define PNX8XXX_IEN 0xfe4
#define PNX8XXX_ICLR 0xfe8
#define PNX8XXX_ISET 0xfec
#define PNX8XXX_PD 0xff4
#define PNX8XXX_MID 0xffc
#define PNX8XXX_UART_LCR_TXBREAK (1<<30)
#define PNX8XXX_UART_LCR_PAREVN 0x10000000
#define PNX8XXX_UART_LCR_PAREN 0x08000000
#define PNX8XXX_UART_LCR_2STOPB 0x04000000
#define PNX8XXX_UART_LCR_8BIT 0x01000000
#define PNX8XXX_UART_LCR_TX_RST 0x00040000
#define PNX8XXX_UART_LCR_RX_RST 0x00020000
#define PNX8XXX_UART_LCR_RX_NEXT 0x00010000
#define PNX8XXX_UART_MCR_SCR 0xFF000000
#define PNX8XXX_UART_MCR_DCD 0x00800000
#define PNX8XXX_UART_MCR_CTS 0x00100000
#define PNX8XXX_UART_MCR_LOOP 0x00000010
#define PNX8XXX_UART_MCR_RTS 0x00000002
#define PNX8XXX_UART_MCR_DTR 0x00000001
#define PNX8XXX_UART_INT_TX 0x00000080
#define PNX8XXX_UART_INT_EMPTY 0x00000040
#define PNX8XXX_UART_INT_RCVTO 0x00000020
#define PNX8XXX_UART_INT_RX 0x00000010
#define PNX8XXX_UART_INT_RXOVRN 0x00000008
#define PNX8XXX_UART_INT_FRERR 0x00000004
#define PNX8XXX_UART_INT_BREAK 0x00000002
#define PNX8XXX_UART_INT_PARITY 0x00000001
#define PNX8XXX_UART_INT_ALLRX 0x0000003F
#define PNX8XXX_UART_INT_ALLTX 0x000000C0
#define PNX8XXX_UART_FIFO_TXFIFO 0x001F0000
#define PNX8XXX_UART_FIFO_TXFIFO_STA (0x1f<<16)
#define PNX8XXX_UART_FIFO_RXBRK 0x00008000
#define PNX8XXX_UART_FIFO_RXFE 0x00004000
#define PNX8XXX_UART_FIFO_RXPAR 0x00002000
#define PNX8XXX_UART_FIFO_RXFIFO 0x00001F00
#define PNX8XXX_UART_FIFO_RBRTHR 0x000000FF
#endif
Computing file changes ...
