From: Anton Ivanov <anton.iva...@cambridgegreys.com>

commit 97be7ceaf7fea68104824b6aa874cff235333ac1 upstream.

asprintf is not compatible with the existing uml memory allocation
mechanism. Its use on the "user" side of UML results in a corrupt slab
state.

Fixes: 0d4e5ac7e780 ("um: remove uses of variable length arrays")
Cc: sta...@vger.kernel.org
Signed-off-by: Anton Ivanov <anton.iva...@cambridgegreys.com>
Signed-off-by: Richard Weinberger <rich...@nod.at>
Signed-off-by: Greg Kroah-Hartman <gre...@linuxfoundation.org>

---
 arch/um/os-Linux/umid.c |   17 +++++------------
 1 file changed, 5 insertions(+), 12 deletions(-)

--- a/arch/um/os-Linux/umid.c
+++ b/arch/um/os-Linux/umid.c
@@ -137,20 +137,13 @@ static inline int is_umdir_used(char *di
 {
        char pid[sizeof("nnnnn\0")], *end, *file;
        int dead, fd, p, n, err;
-       size_t filelen;
+       size_t filelen = strlen(dir) + sizeof("/pid") + 1;
 
-       err = asprintf(&file, "%s/pid", dir);
-       if (err < 0)
-               return 0;
+       file = malloc(filelen);
+       if (!file)
+               return -ENOMEM;
 
-       filelen = strlen(file);
-
-       n = snprintf(file, filelen, "%s/pid", dir);
-       if (n >= filelen) {
-               printk(UM_KERN_ERR "is_umdir_used - pid filename too long\n");
-               err = -E2BIG;
-               goto out;
-       }
+       snprintf(file, filelen, "%s/pid", dir);
 
        dead = 0;
        fd = open(file, O_RDONLY);


Reply via email to