redonkable/remarkable-linux
redonkable/remarkable-linux
1
0
Fork 0
Code Releases Activity

reiserfs: prepare_error_buf wrongly consumes va_arg

Browse source 
vsprintf will consume varargs on its own. Skipping them manually
results in garbage in the error buffer, or Oopses in the case of
pointers.

This patch removes the advancement and fixes a number of bugs where
crashes were observed as side effects of a regular error report.

Signed-off-by: Jeff Mahoney <jeffm@suse.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
This commit is contained in:
Jeff Mahoney 2009-03-30 14:02:22 -04:00 committed by Linus Torvalds
parent 45b03d5e8e
commit cacbe3d7ad
1 changed files with 3 additions and 9 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

12
fs/reiserfs/prints.c
View file

@ -157,19 +157,16 @@ static void sprintf_disk_child(char *buf, struct disk_child *dc)
dc_size(dc)); dc_size(dc));
} }
static char *is_there_reiserfs_struct(char *fmt, int *what, int *skip) static char *is_there_reiserfs_struct(char *fmt, int *what)
{ {
char *k = fmt; char *k = fmt;
*skip = 0;
while ((k = strchr(k, '%')) != NULL) { while ((k = strchr(k, '%')) != NULL) {
if (k[1] == 'k' || k[1] == 'K' || k[1] == 'h' || k[1] == 't' || if (k[1] == 'k' || k[1] == 'K' || k[1] == 'h' || k[1] == 't' ||
k[1] == 'z' || k[1] == 'b' || k[1] == 'y' || k[1] == 'a') { k[1] == 'z' || k[1] == 'b' || k[1] == 'y' || k[1] == 'a') {
*what = k[1]; *what = k[1];
break; break;
} }
(*skip)++;
k++; k++;
} }
return k; return k;
@ -193,18 +190,15 @@ static void prepare_error_buf(const char *fmt, va_list args)
char *fmt1 = fmt_buf; char *fmt1 = fmt_buf;
char *k; char *k;
char *p = error_buf; char *p = error_buf;
int i, j, what, skip; int what;
strcpy(fmt1, fmt); strcpy(fmt1, fmt);
while ((k = is_there_reiserfs_struct(fmt1, &what, &skip)) != NULL) { while ((k = is_there_reiserfs_struct(fmt1, &what)) != NULL) {
*k = 0; *k = 0;
p += vsprintf(p, fmt1, args); p += vsprintf(p, fmt1, args);
for (i = 0; i < skip; i++)
j = va_arg(args, int);
switch (what) { switch (what) {
case 'k': case 'k':
sprintf_le_key(p, va_arg(args, struct reiserfs_key *)); sprintf_le_key(p, va_arg(args, struct reiserfs_key *));