memcg: use scnprintf instead of sprintf

Make sure we don't overflow.

Signed-off-by: Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>
Cc: KAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com>
Cc: Hillf Danton <dhillf@gmail.com>
Cc: Michal Hocko <mhocko@suse.cz>
Cc: Andrea Arcangeli <aarcange@redhat.com>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>

diff --git a/mm/memcontrol.c b/mm/memcontrol.c
index 4ce78fa54df9d2aca79f9b2ac70ec5a7ede7f524..e27ba7f44db18b31e5bc130024762b8eab08404e 100644 (file)
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -5190,14 +5190,14 @@ static void mem_cgroup_destroy(struct cgroup *cont)
 }
 
 #ifdef CONFIG_MEM_RES_CTLR_HUGETLB
-static char *mem_fmt(char *buf, unsigned long n)
+static char *mem_fmt(char *buf, int size, unsigned long hsize)
 {
-       if (n >= (1UL << 30))
-               sprintf(buf, "%luGB", n >> 30);
-       else if (n >= (1UL << 20))
-               sprintf(buf, "%luMB", n >> 20);
+       if (hsize >= (1UL << 30))
+               scnprintf(buf, size, "%luGB", hsize >> 30);
+       else if (hsize >= (1UL << 20))
+               scnprintf(buf, size, "%luMB", hsize >> 20);
        else
-               sprintf(buf, "%luKB", n >> 10);
+               scnprintf(buf, size, "%luKB", hsize >> 10);
        return buf;
 }
 
@@ -5208,7 +5208,7 @@ int __init mem_cgroup_hugetlb_file_init(int idx)
        struct hstate *h = &hstates[idx];
 
        /* format the size */
-       mem_fmt(buf, huge_page_size(h));
+       mem_fmt(buf, 32, huge_page_size(h));
 
        /* Add the limit file */
        cft = &h->mem_cgroup_files[0];