From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S932078AbbHCP0F (ORCPT ); Mon, 3 Aug 2015 11:26:05 -0400 Received: from 8bytes.org ([81.169.241.247]:54373 "EHLO theia.8bytes.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752231AbbHCP0A (ORCPT ); Mon, 3 Aug 2015 11:26:00 -0400 Date: Mon, 3 Aug 2015 17:25:58 +0200 From: Joerg Roedel To: Salva =?iso-8859-1?Q?Peir=F3?= Cc: iommu@lists.linux-foundation.org, linux-kernel@vger.kernel.org Subject: Re: [PATCH] iommu/omap: Fix debug_read_tlb() to use seq_printf() Message-ID: <20150803152557.GF20968@8bytes.org> References: <1437654379-13356-1-git-send-email-speirofr@gmail.com> MIME-Version: 1.0 Content-Type: text/plain; charset=iso-8859-1 Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: <1437654379-13356-1-git-send-email-speirofr@gmail.com> User-Agent: Mutt/1.5.21 (2010-09-15) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Thu, Jul 23, 2015 at 02:26:19PM +0200, Salva Peiró wrote: > The debug_read_tlb() uses the sprintf() functions directly on the buffer > allocated by buf = kmalloc(count), without taking into account the size > of the buffer, with the consequence corrupting the heap, depending on > the count requested by the user. > > The patch fixes the issue replacing sprintf() by seq_printf(). > > Signed-off-by: Salva Peiró > --- > drivers/iommu/omap-iommu-debug.c | 26 +++++++------------------- > drivers/iommu/omap-iommu.c | 28 +++++++++++----------------- > drivers/iommu/omap-iommu.h | 3 +-- > 3 files changed, 19 insertions(+), 38 deletions(-) Applied, thanks. I had to rebase it on top of Suman's changes, but that wasn't too hard.