From: "Paul E. McKenney" paulmck@kernel.org
The Tree and Tiny implementations of rcutorture_format_gp_seqs() use hard-coded constants for the length of the buffer that they format into. This is of course an accident waiting to happen, so this commit therefore makes them take a length argument. The rcutorture calling code uses ARRAY_SIZE() to safely compute this new argument.
Signed-off-by: Paul E. McKenney paulmck@kernel.org Signed-off-by: Boqun Feng boqun.feng@gmail.com --- kernel/rcu/rcu.h | 2 +- kernel/rcu/rcutorture.c | 8 +++++--- kernel/rcu/tiny.c | 4 ++-- kernel/rcu/tree.c | 4 ++-- 4 files changed, 10 insertions(+), 8 deletions(-)
diff --git a/kernel/rcu/rcu.h b/kernel/rcu/rcu.h index 705fcbe6f500..82d8b494cc30 100644 --- a/kernel/rcu/rcu.h +++ b/kernel/rcu/rcu.h @@ -591,7 +591,7 @@ void do_trace_rcu_torture_read(const char *rcutorturename, static inline void rcu_gp_set_torture_wait(int duration) { } #endif unsigned long long rcutorture_gather_gp_seqs(void); -void rcutorture_format_gp_seqs(unsigned long long seqs, char *cp); +void rcutorture_format_gp_seqs(unsigned long long seqs, char *cp, size_t len);
#ifdef CONFIG_TINY_SRCU
diff --git a/kernel/rcu/rcutorture.c b/kernel/rcu/rcutorture.c index 1fdadc1df9ad..9c9a349b9c7f 100644 --- a/kernel/rcu/rcutorture.c +++ b/kernel/rcu/rcutorture.c @@ -411,7 +411,7 @@ struct rcu_torture_ops { void (*gp_slow_unregister)(atomic_t *rgssp); bool (*reader_blocked)(void); unsigned long long (*gather_gp_seqs)(void); - void (*format_gp_seqs)(unsigned long long seqs, char *cp); + void (*format_gp_seqs)(unsigned long long seqs, char *cp, size_t len); long cbflood_max; int irq_capable; int can_boost; @@ -3688,8 +3688,10 @@ rcu_torture_cleanup(void) char buf2[20+1]; char sepchar = '-';
- cur_ops->format_gp_seqs(err_segs[i].rt_gp_seq, buf1); - cur_ops->format_gp_seqs(err_segs[i].rt_gp_seq_end, buf2); + cur_ops->format_gp_seqs(err_segs[i].rt_gp_seq, + buf1, ARRAY_SIZE(buf1)); + cur_ops->format_gp_seqs(err_segs[i].rt_gp_seq_end, + buf2, ARRAY_SIZE(buf2)); if (err_segs[i].rt_gp_seq == err_segs[i].rt_gp_seq_end) { if (buf2[0]) { for (j = 0; buf2[j]; j++) diff --git a/kernel/rcu/tiny.c b/kernel/rcu/tiny.c index 8cbec3401184..8a52aca686a5 100644 --- a/kernel/rcu/tiny.c +++ b/kernel/rcu/tiny.c @@ -264,9 +264,9 @@ unsigned long long rcutorture_gather_gp_seqs(void) } EXPORT_SYMBOL_GPL(rcutorture_gather_gp_seqs);
-void rcutorture_format_gp_seqs(unsigned long long seqs, char *cp) +void rcutorture_format_gp_seqs(unsigned long long seqs, char *cp, size_t len) { - snprintf(cp, 8, "g%04llx", seqs & 0xffffULL); + snprintf(cp, len, "g%04llx", seqs & 0xffffULL); } EXPORT_SYMBOL_GPL(rcutorture_format_gp_seqs); #endif diff --git a/kernel/rcu/tree.c b/kernel/rcu/tree.c index 83cba3d2cc48..bb061e5870c3 100644 --- a/kernel/rcu/tree.c +++ b/kernel/rcu/tree.c @@ -548,13 +548,13 @@ unsigned long long rcutorture_gather_gp_seqs(void) EXPORT_SYMBOL_GPL(rcutorture_gather_gp_seqs);
/* Format grace-period sequence numbers for rcutorture diagnostics. */ -void rcutorture_format_gp_seqs(unsigned long long seqs, char *cp) +void rcutorture_format_gp_seqs(unsigned long long seqs, char *cp, size_t len) { unsigned int egp = (seqs >> 16) & 0xffffffULL; unsigned int ggp = (seqs >> 40) & 0xffffULL; unsigned int pgp = seqs & 0xffffULL;
- snprintf(cp, 20, "g%04x:e%06x:p%04x", ggp, egp, pgp); + snprintf(cp, len, "g%04x:e%06x:p%04x", ggp, egp, pgp); } EXPORT_SYMBOL_GPL(rcutorture_format_gp_seqs);