Commit f170168b authored by Kees Cook's avatar Kees Cook Committed by Linus Torvalds

drivers: avoid parsing names as kthread_run() format strings

Calling kthread_run with a single name parameter causes it to be handled
as a format string. Many callers are passing potentially dynamic string
content, so use "%s" in those cases to avoid any potential accidents.
Signed-off-by: default avatarKees Cook <keescook@chromium.org>
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
parent d8537548
...@@ -1340,7 +1340,7 @@ aoe_ktstart(struct ktstate *k) ...@@ -1340,7 +1340,7 @@ aoe_ktstart(struct ktstate *k)
struct task_struct *task; struct task_struct *task;
init_completion(&k->rendez); init_completion(&k->rendez);
task = kthread_run(kthread, k, k->name); task = kthread_run(kthread, k, "%s", k->name);
if (task == NULL || IS_ERR(task)) if (task == NULL || IS_ERR(task))
return -ENOMEM; return -ENOMEM;
k->task = task; k->task = task;
......
...@@ -4087,7 +4087,8 @@ static int mtip_block_initialize(struct driver_data *dd) ...@@ -4087,7 +4087,8 @@ static int mtip_block_initialize(struct driver_data *dd)
start_service_thread: start_service_thread:
sprintf(thd_name, "mtip_svc_thd_%02d", index); sprintf(thd_name, "mtip_svc_thd_%02d", index);
dd->mtip_svc_handler = kthread_create_on_node(mtip_service_thread, dd->mtip_svc_handler = kthread_create_on_node(mtip_service_thread,
dd, dd->numa_node, thd_name); dd, dd->numa_node, "%s",
thd_name);
if (IS_ERR(dd->mtip_svc_handler)) { if (IS_ERR(dd->mtip_svc_handler)) {
dev_err(&dd->pdev->dev, "service thread failed to start\n"); dev_err(&dd->pdev->dev, "service thread failed to start\n");
......
...@@ -93,7 +93,7 @@ static void xen_update_blkif_status(struct xen_blkif *blkif) ...@@ -93,7 +93,7 @@ static void xen_update_blkif_status(struct xen_blkif *blkif)
} }
invalidate_inode_pages2(blkif->vbd.bdev->bd_inode->i_mapping); invalidate_inode_pages2(blkif->vbd.bdev->bd_inode->i_mapping);
blkif->xenblkd = kthread_run(xen_blkif_schedule, blkif, name); blkif->xenblkd = kthread_run(xen_blkif_schedule, blkif, "%s", name);
if (IS_ERR(blkif->xenblkd)) { if (IS_ERR(blkif->xenblkd)) {
err = PTR_ERR(blkif->xenblkd); err = PTR_ERR(blkif->xenblkd);
blkif->xenblkd = NULL; blkif->xenblkd = NULL;
......
...@@ -1285,7 +1285,7 @@ static int adt7470_probe(struct i2c_client *client, ...@@ -1285,7 +1285,7 @@ static int adt7470_probe(struct i2c_client *client,
} }
init_completion(&data->auto_update_stop); init_completion(&data->auto_update_stop);
data->auto_update = kthread_run(adt7470_update_thread, client, data->auto_update = kthread_run(adt7470_update_thread, client, "%s",
dev_name(data->hwmon_dev)); dev_name(data->hwmon_dev));
if (IS_ERR(data->auto_update)) { if (IS_ERR(data->auto_update)) {
err = PTR_ERR(data->auto_update); err = PTR_ERR(data->auto_update);
......
...@@ -2020,7 +2020,8 @@ static int tvaudio_probe(struct i2c_client *client, const struct i2c_device_id * ...@@ -2020,7 +2020,8 @@ static int tvaudio_probe(struct i2c_client *client, const struct i2c_device_id *
/* start async thread */ /* start async thread */
chip->wt.function = chip_thread_wake; chip->wt.function = chip_thread_wake;
chip->wt.data = (unsigned long)chip; chip->wt.data = (unsigned long)chip;
chip->thread = kthread_run(chip_thread, chip, client->name); chip->thread = kthread_run(chip_thread, chip, "%s",
client->name);
if (IS_ERR(chip->thread)) { if (IS_ERR(chip->thread)) {
v4l2_warn(sd, "failed to create kthread\n"); v4l2_warn(sd, "failed to create kthread\n");
chip->thread = NULL; chip->thread = NULL;
......
...@@ -753,7 +753,7 @@ static int ivtv_init_struct1(struct ivtv *itv) ...@@ -753,7 +753,7 @@ static int ivtv_init_struct1(struct ivtv *itv)
init_kthread_worker(&itv->irq_worker); init_kthread_worker(&itv->irq_worker);
itv->irq_worker_task = kthread_run(kthread_worker_fn, &itv->irq_worker, itv->irq_worker_task = kthread_run(kthread_worker_fn, &itv->irq_worker,
itv->v4l2_dev.name); "%s", itv->v4l2_dev.name);
if (IS_ERR(itv->irq_worker_task)) { if (IS_ERR(itv->irq_worker_task)) {
IVTV_ERR("Could not create ivtv task\n"); IVTV_ERR("Could not create ivtv task\n");
return -1; return -1;
......
...@@ -768,7 +768,8 @@ static int vivi_start_generating(struct vivi_dev *dev) ...@@ -768,7 +768,8 @@ static int vivi_start_generating(struct vivi_dev *dev)
dma_q->frame = 0; dma_q->frame = 0;
dma_q->ini_jiffies = jiffies; dma_q->ini_jiffies = jiffies;
dma_q->kthread = kthread_run(vivi_thread, dev, dev->v4l2_dev.name); dma_q->kthread = kthread_run(vivi_thread, dev, "%s",
dev->v4l2_dev.name);
if (IS_ERR(dma_q->kthread)) { if (IS_ERR(dma_q->kthread)) {
v4l2_err(&dev->v4l2_dev, "kernel_thread() failed\n"); v4l2_err(&dev->v4l2_dev, "kernel_thread() failed\n");
......
...@@ -1005,7 +1005,7 @@ int ubi_attach_mtd_dev(struct mtd_info *mtd, int ubi_num, ...@@ -1005,7 +1005,7 @@ int ubi_attach_mtd_dev(struct mtd_info *mtd, int ubi_num,
if (err) if (err)
goto out_uif; goto out_uif;
ubi->bgt_thread = kthread_create(ubi_thread, ubi, ubi->bgt_name); ubi->bgt_thread = kthread_create(ubi_thread, ubi, "%s", ubi->bgt_name);
if (IS_ERR(ubi->bgt_thread)) { if (IS_ERR(ubi->bgt_thread)) {
err = PTR_ERR(ubi->bgt_thread); err = PTR_ERR(ubi->bgt_thread);
ubi_err("cannot spawn \"%s\", error %d", ubi->bgt_name, ubi_err("cannot spawn \"%s\", error %d", ubi->bgt_name,
......
...@@ -1893,7 +1893,8 @@ static int airo_open(struct net_device *dev) { ...@@ -1893,7 +1893,8 @@ static int airo_open(struct net_device *dev) {
if (ai->wifidev != dev) { if (ai->wifidev != dev) {
clear_bit(JOB_DIE, &ai->jobs); clear_bit(JOB_DIE, &ai->jobs);
ai->airo_thread_task = kthread_run(airo_thread, dev, dev->name); ai->airo_thread_task = kthread_run(airo_thread, dev, "%s",
dev->name);
if (IS_ERR(ai->airo_thread_task)) if (IS_ERR(ai->airo_thread_task))
return (int)PTR_ERR(ai->airo_thread_task); return (int)PTR_ERR(ai->airo_thread_task);
......
...@@ -318,7 +318,8 @@ static int next_getadapter_fib(struct aac_dev * dev, void __user *arg) ...@@ -318,7 +318,8 @@ static int next_getadapter_fib(struct aac_dev * dev, void __user *arg)
kthread_stop(dev->thread); kthread_stop(dev->thread);
ssleep(1); ssleep(1);
dev->aif_thread = 0; dev->aif_thread = 0;
dev->thread = kthread_run(aac_command_thread, dev, dev->name); dev->thread = kthread_run(aac_command_thread, dev,
"%s", dev->name);
ssleep(1); ssleep(1);
} }
if (f.wait) { if (f.wait) {
......
...@@ -1336,7 +1336,8 @@ static int _aac_reset_adapter(struct aac_dev *aac, int forced) ...@@ -1336,7 +1336,8 @@ static int _aac_reset_adapter(struct aac_dev *aac, int forced)
if ((retval = pci_set_dma_mask(aac->pdev, DMA_BIT_MASK(32)))) if ((retval = pci_set_dma_mask(aac->pdev, DMA_BIT_MASK(32))))
goto out; goto out;
if (jafo) { if (jafo) {
aac->thread = kthread_run(aac_command_thread, aac, aac->name); aac->thread = kthread_run(aac_command_thread, aac, "%s",
aac->name);
if (IS_ERR(aac->thread)) { if (IS_ERR(aac->thread)) {
retval = PTR_ERR(aac->thread); retval = PTR_ERR(aac->thread);
goto out; goto out;
......
...@@ -601,7 +601,7 @@ static int spi_init_queue(struct spi_master *master) ...@@ -601,7 +601,7 @@ static int spi_init_queue(struct spi_master *master)
init_kthread_worker(&master->kworker); init_kthread_worker(&master->kworker);
master->kworker_task = kthread_run(kthread_worker_fn, master->kworker_task = kthread_run(kthread_worker_fn,
&master->kworker, &master->kworker, "%s",
dev_name(&master->dev)); dev_name(&master->dev));
if (IS_ERR(master->kworker_task)) { if (IS_ERR(master->kworker_task)) {
dev_err(&master->dev, "failed to create message pump task\n"); dev_err(&master->dev, "failed to create message pump task\n");
......
...@@ -238,7 +238,7 @@ struct net_device *r8712_init_netdev(void) ...@@ -238,7 +238,7 @@ struct net_device *r8712_init_netdev(void)
static u32 start_drv_threads(struct _adapter *padapter) static u32 start_drv_threads(struct _adapter *padapter)
{ {
padapter->cmdThread = kthread_run(r8712_cmd_thread, padapter, padapter->cmdThread = kthread_run(r8712_cmd_thread, padapter, "%s",
padapter->pnetdev->name); padapter->pnetdev->name);
if (IS_ERR(padapter->cmdThread) < 0) if (IS_ERR(padapter->cmdThread) < 0)
return _FAIL; return _FAIL;
......
...@@ -1020,7 +1020,7 @@ static int usbatm_heavy_init(struct usbatm_data *instance) ...@@ -1020,7 +1020,7 @@ static int usbatm_heavy_init(struct usbatm_data *instance)
{ {
struct task_struct *t; struct task_struct *t;
t = kthread_create(usbatm_do_heavy_init, instance, t = kthread_create(usbatm_do_heavy_init, instance, "%s",
instance->driver->driver_name); instance->driver->driver_name);
if (IS_ERR(t)) { if (IS_ERR(t)) {
usb_err(instance, "%s: failed to create kernel_thread (%ld)!\n", usb_err(instance, "%s: failed to create kernel_thread (%ld)!\n",
...@@ -1076,7 +1076,8 @@ int usbatm_usb_probe(struct usb_interface *intf, const struct usb_device_id *id, ...@@ -1076,7 +1076,8 @@ int usbatm_usb_probe(struct usb_interface *intf, const struct usb_device_id *id,
/* public fields */ /* public fields */
instance->driver = driver; instance->driver = driver;
snprintf(instance->driver_name, sizeof(instance->driver_name), driver->driver_name); strlcpy(instance->driver_name, driver->driver_name,
sizeof(instance->driver_name));
instance->usb_dev = usb_dev; instance->usb_dev = usb_dev;
instance->usb_intf = intf; instance->usb_intf = intf;
......
...@@ -305,7 +305,7 @@ static int lockd_start_svc(struct svc_serv *serv) ...@@ -305,7 +305,7 @@ static int lockd_start_svc(struct svc_serv *serv)
svc_sock_update_bufs(serv); svc_sock_update_bufs(serv);
serv->sv_maxconn = nlm_max_connections; serv->sv_maxconn = nlm_max_connections;
nlmsvc_task = kthread_run(lockd, nlmsvc_rqst, serv->sv_name); nlmsvc_task = kthread_run(lockd, nlmsvc_rqst, "%s", serv->sv_name);
if (IS_ERR(nlmsvc_task)) { if (IS_ERR(nlmsvc_task)) {
error = PTR_ERR(nlmsvc_task); error = PTR_ERR(nlmsvc_task);
printk(KERN_WARNING printk(KERN_WARNING
......
...@@ -211,7 +211,6 @@ static int nfs_callback_start_svc(int minorversion, struct rpc_xprt *xprt, ...@@ -211,7 +211,6 @@ static int nfs_callback_start_svc(int minorversion, struct rpc_xprt *xprt,
struct svc_rqst *rqstp; struct svc_rqst *rqstp;
int (*callback_svc)(void *vrqstp); int (*callback_svc)(void *vrqstp);
struct nfs_callback_data *cb_info = &nfs_callback_info[minorversion]; struct nfs_callback_data *cb_info = &nfs_callback_info[minorversion];
char svc_name[12];
int ret; int ret;
nfs_callback_bc_serv(minorversion, xprt, serv); nfs_callback_bc_serv(minorversion, xprt, serv);
...@@ -235,10 +234,10 @@ static int nfs_callback_start_svc(int minorversion, struct rpc_xprt *xprt, ...@@ -235,10 +234,10 @@ static int nfs_callback_start_svc(int minorversion, struct rpc_xprt *xprt,
svc_sock_update_bufs(serv); svc_sock_update_bufs(serv);
sprintf(svc_name, "nfsv4.%u-svc", minorversion);
cb_info->serv = serv; cb_info->serv = serv;
cb_info->rqst = rqstp; cb_info->rqst = rqstp;
cb_info->task = kthread_run(callback_svc, cb_info->rqst, svc_name); cb_info->task = kthread_run(callback_svc, cb_info->rqst,
"nfsv4.%u-svc", minorversion);
if (IS_ERR(cb_info->task)) { if (IS_ERR(cb_info->task)) {
ret = PTR_ERR(cb_info->task); ret = PTR_ERR(cb_info->task);
svc_exit_thread(cb_info->rqst); svc_exit_thread(cb_info->rqst);
......
...@@ -1194,7 +1194,7 @@ void nfs4_schedule_state_manager(struct nfs_client *clp) ...@@ -1194,7 +1194,7 @@ void nfs4_schedule_state_manager(struct nfs_client *clp)
snprintf(buf, sizeof(buf), "%s-manager", snprintf(buf, sizeof(buf), "%s-manager",
rpc_peeraddr2str(clp->cl_rpcclient, RPC_DISPLAY_ADDR)); rpc_peeraddr2str(clp->cl_rpcclient, RPC_DISPLAY_ADDR));
rcu_read_unlock(); rcu_read_unlock();
task = kthread_run(nfs4_run_state_manager, clp, buf); task = kthread_run(nfs4_run_state_manager, clp, "%s", buf);
if (IS_ERR(task)) { if (IS_ERR(task)) {
printk(KERN_ERR "%s: kthread_run: %ld\n", printk(KERN_ERR "%s: kthread_run: %ld\n",
__func__, PTR_ERR(task)); __func__, PTR_ERR(task));
......
...@@ -3026,7 +3026,7 @@ static int __init rcu_spawn_gp_kthread(void) ...@@ -3026,7 +3026,7 @@ static int __init rcu_spawn_gp_kthread(void)
struct task_struct *t; struct task_struct *t;
for_each_rcu_flavor(rsp) { for_each_rcu_flavor(rsp) {
t = kthread_run(rcu_gp_kthread, rsp, rsp->name); t = kthread_run(rcu_gp_kthread, rsp, "%s", rsp->name);
BUG_ON(IS_ERR(t)); BUG_ON(IS_ERR(t));
rnp = rcu_get_root(rsp); rnp = rcu_get_root(rsp);
raw_spin_lock_irqsave(&rnp->lock, flags); raw_spin_lock_irqsave(&rnp->lock, flags);
......
...@@ -740,7 +740,7 @@ svc_set_num_threads(struct svc_serv *serv, struct svc_pool *pool, int nrservs) ...@@ -740,7 +740,7 @@ svc_set_num_threads(struct svc_serv *serv, struct svc_pool *pool, int nrservs)
__module_get(serv->sv_module); __module_get(serv->sv_module);
task = kthread_create_on_node(serv->sv_function, rqstp, task = kthread_create_on_node(serv->sv_function, rqstp,
node, serv->sv_name); node, "%s", serv->sv_name);
if (IS_ERR(task)) { if (IS_ERR(task)) {
error = PTR_ERR(task); error = PTR_ERR(task);
module_put(serv->sv_module); module_put(serv->sv_module);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment