mm, mempolicy: make mpol_to_str robust and always succeed

mpol_to_str() should not fail.  Currently, it either fails because the
string buffer is too small or because a string hasn't been defined for a
mempolicy mode.

If a new mempolicy mode is introduced and no string is defined for it,
just warn and return "unknown".

If the buffer is too small, just truncate the string and return, the
same behavior as snprintf().

This also fixes a bug where there was no NULL-byte termination when doing
*p++ = '=' and *p++ ':' and maxlen has been reached.

Signed-off-by: David Rientjes <rientjes@google.com>
Cc: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
Cc: Chen Gang <gang.chen@asianux.com>
Cc: Rik van Riel <riel@redhat.com>
Cc: Dave Jones <davej@redhat.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

1 files changed, 16 insertions, 36 deletions

diff --git a/mm/mempolicy.c b/mm/mempolicy.c
index 71cb253368cb..260b8213a873 100644
--- a/mm/mempolicy.c
+++ b/mm/mempolicy.c
@@ -2914,62 +2914,45 @@ out:
  * @maxlen:  length of @buffer
  * @pol:  pointer to mempolicy to be formatted
  *
- * Convert a mempolicy into a string.
- * Returns the number of characters in buffer (if positive)
- * or an error (negative)
+ * Convert @pol into a string.  If @buffer is too short, truncate the string.
+ * Recommend a @maxlen of at least 32 for the longest mode, "interleave", the
+ * longest flag, "relative", and to display at least a few node ids.
  */
-int mpol_to_str(char *buffer, int maxlen, struct mempolicy *pol)
+void mpol_to_str(char *buffer, int maxlen, struct mempolicy *pol)
 {
         char *p = buffer;
-        int l;
-        nodemask_t nodes;
-        unsigned short mode;
-        unsigned short flags = pol ? pol->flags : 0;
-
-        /*
-         * Sanity check:  room for longest mode, flag and some nodes
-         */
-        VM_BUG_ON(maxlen < strlen("interleave") + strlen("relative") + 16);
+        nodemask_t nodes = NODE_MASK_NONE;
+        unsigned short mode = MPOL_DEFAULT;
+        unsigned short flags = 0;
 
-        if (!pol || pol == &default_policy)
-                mode = MPOL_DEFAULT;
-        else
+        if (pol && pol != &default_policy) {
                 mode = pol->mode;
+                flags = pol->flags;
+        }
 
         switch (mode) {
         case MPOL_DEFAULT:
-                nodes_clear(nodes);
                 break;
-
         case MPOL_PREFERRED:
-                nodes_clear(nodes);
                 if (flags & MPOL_F_LOCAL)
                         mode = MPOL_LOCAL;
                 else
                         node_set(pol->v.preferred_node, nodes);
                 break;
-
         case MPOL_BIND:
-                /* Fall through */
         case MPOL_INTERLEAVE:
                 nodes = pol->v.nodes;
                 break;
-
         default:
-                return -EINVAL;
+                WARN_ON_ONCE(1);
+                snprintf(p, maxlen, "unknown");
+                return;
         }
 
-        l = strlen(policy_modes[mode]);
-        if (buffer + maxlen < p + l + 1)
-                return -ENOSPC;
-
-        strcpy(p, policy_modes[mode]);
-        p += l;
+        p += snprintf(p, maxlen, policy_modes[mode]);
 
         if (flags & MPOL_MODE_FLAGS) {
-                if (buffer + maxlen < p + 2)
-                        return -ENOSPC;
-                *p++ = '=';
+                p += snprintf(p, buffer + maxlen - p, "=");
 
                 /*
                  * Currently, the only defined flags are mutually exclusive
@@ -2981,10 +2964,7 @@ int mpol_to_str(char *buffer, int maxlen, struct mempolicy *pol)
         }
 
         if (!nodes_empty(nodes)) {
-                if (buffer + maxlen < p + 2)
-                        return -ENOSPC;
-                *p++ = ':';
+                p += snprintf(p, buffer + maxlen - p, ":");
                 p += nodelist_scnprintf(p, buffer + maxlen - p, nodes);
         }
-        return p - buffer;
 }