[S390] early: Fix possible overlapping data buffer
This patch fixed bugzilla #12965: https://bugzilla.kernel.org/show_bug.cgi?id=12965 The original code contains some inproper use of sprintf function where a buffer is used both as input string as well as output string. It should remember the written bytes in the previous and use that as the offset for later writing. Also replace sprintf with snprintf. Signed-off-by: Chen Liu <chenliu@asset.uwaterloo.ca> Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
This commit is contained in:
parent
6447f55da9
commit
69ac43b05e
|
@ -94,6 +94,7 @@ static noinline __init void create_kernel_nss(void)
|
||||||
unsigned int sinitrd_pfn, einitrd_pfn;
|
unsigned int sinitrd_pfn, einitrd_pfn;
|
||||||
#endif
|
#endif
|
||||||
int response;
|
int response;
|
||||||
|
int hlen;
|
||||||
size_t len;
|
size_t len;
|
||||||
char *savesys_ptr;
|
char *savesys_ptr;
|
||||||
char defsys_cmd[DEFSYS_CMD_SIZE];
|
char defsys_cmd[DEFSYS_CMD_SIZE];
|
||||||
|
@ -124,22 +125,24 @@ static noinline __init void create_kernel_nss(void)
|
||||||
end_pfn = PFN_UP(__pa(&_end));
|
end_pfn = PFN_UP(__pa(&_end));
|
||||||
min_size = end_pfn << 2;
|
min_size = end_pfn << 2;
|
||||||
|
|
||||||
sprintf(defsys_cmd, "DEFSYS %s 00000-%.5X EW %.5X-%.5X SR %.5X-%.5X",
|
hlen = snprintf(defsys_cmd, DEFSYS_CMD_SIZE,
|
||||||
kernel_nss_name, stext_pfn - 1, stext_pfn, eshared_pfn - 1,
|
"DEFSYS %s 00000-%.5X EW %.5X-%.5X SR %.5X-%.5X",
|
||||||
eshared_pfn, end_pfn);
|
kernel_nss_name, stext_pfn - 1, stext_pfn,
|
||||||
|
eshared_pfn - 1, eshared_pfn, end_pfn);
|
||||||
|
|
||||||
#ifdef CONFIG_BLK_DEV_INITRD
|
#ifdef CONFIG_BLK_DEV_INITRD
|
||||||
if (INITRD_START && INITRD_SIZE) {
|
if (INITRD_START && INITRD_SIZE) {
|
||||||
sinitrd_pfn = PFN_DOWN(__pa(INITRD_START));
|
sinitrd_pfn = PFN_DOWN(__pa(INITRD_START));
|
||||||
einitrd_pfn = PFN_UP(__pa(INITRD_START + INITRD_SIZE));
|
einitrd_pfn = PFN_UP(__pa(INITRD_START + INITRD_SIZE));
|
||||||
min_size = einitrd_pfn << 2;
|
min_size = einitrd_pfn << 2;
|
||||||
sprintf(defsys_cmd, "%s EW %.5X-%.5X", defsys_cmd,
|
hlen += snprintf(defsys_cmd + hlen, DEFSYS_CMD_SIZE - hlen,
|
||||||
sinitrd_pfn, einitrd_pfn);
|
" EW %.5X-%.5X", sinitrd_pfn, einitrd_pfn);
|
||||||
}
|
}
|
||||||
#endif
|
#endif
|
||||||
|
|
||||||
sprintf(defsys_cmd, "%s EW MINSIZE=%.7iK PARMREGS=0-13",
|
snprintf(defsys_cmd + hlen, DEFSYS_CMD_SIZE - hlen,
|
||||||
defsys_cmd, min_size);
|
" EW MINSIZE=%.7iK PARMREGS=0-13", min_size);
|
||||||
|
defsys_cmd[DEFSYS_CMD_SIZE - 1] = '\0';
|
||||||
sprintf(savesys_cmd, "SAVESYS %s \n IPL %s",
|
sprintf(savesys_cmd, "SAVESYS %s \n IPL %s",
|
||||||
kernel_nss_name, kernel_nss_name);
|
kernel_nss_name, kernel_nss_name);
|
||||||
|
|
||||||
|
|
Loading…
Reference in a new issue