On Thu, Jul 23, 2015 at 02:26:19PM +0200, Salva Peiró wrote: > The debug_read_tlb() uses the sprintf() functions directly on the buffer > allocated by buf = kmalloc(count), without taking into account the size > of the buffer, with the consequence corrupting the heap, depending on > the count requested by the user. > > The patch fixes the issue replacing sprintf() by seq_printf(). > > Signed-off-by: Salva Peiró <speir...@gmail.com> > --- > drivers/iommu/omap-iommu-debug.c | 26 +++++++------------------- > drivers/iommu/omap-iommu.c | 28 +++++++++++----------------- > drivers/iommu/omap-iommu.h | 3 +-- > 3 files changed, 19 insertions(+), 38 deletions(-)
Applied, thanks. I had to rebase it on top of Suman's changes, but that wasn't too hard. _______________________________________________ iommu mailing list iommu@lists.linux-foundation.org https://lists.linuxfoundation.org/mailman/listinfo/iommu
