Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit f170168b authored by Kees Cook's avatar Kees Cook Committed by Linus Torvalds
Browse files

drivers: avoid parsing names as kthread_run() format strings 



Calling kthread_run with a single name parameter causes it to be handled
as a format string. Many callers are passing potentially dynamic string
content, so use "%s" in those cases to avoid any potential accidents.

Signed-off-by: default avatarKees Cook <keescook@chromium.org>
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
parent d8537548

drivers/block/aoe/aoecmd.c

+1 −1
Original line number Diff line number Diff line
@@ -1340,7 +1340,7 @@ aoe_ktstart(struct ktstate *k) 
	struct task_struct *task;



	init_completion(&k->rendez);

	task = kthread_run(kthread, k, k->name);

	task = kthread_run(kthread, k, "%s", k->name);

	if (task == NULL || IS_ERR(task))

		return -ENOMEM;

	k->task = task;

drivers/block/mtip32xx/mtip32xx.c

+2 −1
Original line number Diff line number Diff line
@@ -4087,7 +4087,8 @@ static int mtip_block_initialize(struct driver_data *dd) 
start_service_thread:

	sprintf(thd_name, "mtip_svc_thd_%02d", index);

	dd->mtip_svc_handler = kthread_create_on_node(mtip_service_thread,

						dd, dd->numa_node, thd_name);

						dd, dd->numa_node, "%s",

						thd_name);



	if (IS_ERR(dd->mtip_svc_handler)) {

		dev_err(&dd->pdev->dev, "service thread failed to start\n");

drivers/block/xen-blkback/xenbus.c

+1 −1
Original line number Diff line number Diff line
@@ -93,7 +93,7 @@ static void xen_update_blkif_status(struct xen_blkif *blkif) 
	}

	invalidate_inode_pages2(blkif->vbd.bdev->bd_inode->i_mapping);



	blkif->xenblkd = kthread_run(xen_blkif_schedule, blkif, name);

	blkif->xenblkd = kthread_run(xen_blkif_schedule, blkif, "%s", name);

	if (IS_ERR(blkif->xenblkd)) {

		err = PTR_ERR(blkif->xenblkd);

		blkif->xenblkd = NULL;

drivers/hwmon/adt7470.c

+1 −1
Original line number Diff line number Diff line
@@ -1285,7 +1285,7 @@ static int adt7470_probe(struct i2c_client *client, 
	}



	init_completion(&data->auto_update_stop);

	data->auto_update = kthread_run(adt7470_update_thread, client,

	data->auto_update = kthread_run(adt7470_update_thread, client, "%s",

					dev_name(data->hwmon_dev));

	if (IS_ERR(data->auto_update)) {

		err = PTR_ERR(data->auto_update);

drivers/media/i2c/tvaudio.c

+2 −1
Original line number Diff line number Diff line
@@ -2020,7 +2020,8 @@ static int tvaudio_probe(struct i2c_client *client, const struct i2c_device_id * 
		/* start async thread */

		chip->wt.function = chip_thread_wake;

		chip->wt.data     = (unsigned long)chip;

		chip->thread = kthread_run(chip_thread, chip, client->name);

		chip->thread = kthread_run(chip_thread, chip, "%s",

					   client->name);

		if (IS_ERR(chip->thread)) {

			v4l2_warn(sd, "failed to create kthread\n");

			chip->thread = NULL;