3 files changed, 21 insertions, 6 deletions

diff --git a/drivers/s390/char/sclp_mem.c b/drivers/s390/char/sclp_mem.c
index 676c085b4f8a..27f0d2f12a8b 100644
--- a/drivers/s390/char/sclp_mem.c
+++ b/drivers/s390/char/sclp_mem.c
@@ -44,6 +44,9 @@ struct sclp_mem {
 	unsigned int id;
 	unsigned int memmap_on_memory;
 	unsigned int config;
+#ifdef CONFIG_KASAN
+	unsigned int early_shadow_mapped;
+#endif
 };
 
 struct sclp_mem_arg {
@@ -244,6 +247,16 @@ static ssize_t sclp_config_mem_store(struct kobject *kobj, struct kobj_attribute
 		put_device(&mem->dev);
 		sclp_mem_change_state(addr, block_size, 0);
 		__remove_memory(addr, block_size);
+#ifdef CONFIG_KASAN
+		if (sclp_mem->early_shadow_mapped) {
+			unsigned long start, end;
+
+			start = (unsigned long)kasan_mem_to_shadow(__va(addr));
+			end = start + (block_size >> KASAN_SHADOW_SCALE_SHIFT);
+			vmemmap_free(start, end, NULL);
+			sclp_mem->early_shadow_mapped = 0;
+		}
+#endif
 		WRITE_ONCE(sclp_mem->config, 0);
 	}
 out_unlock:
@@ -316,6 +329,9 @@ static int sclp_create_mem(struct sclp_mem *sclp_mem, struct kset *kset,
 
 	sclp_mem->memmap_on_memory = memmap_on_memory;
 	sclp_mem->config = config;
+#ifdef CONFIG_KASAN
+	sclp_mem->early_shadow_mapped = config;
+#endif
 	sclp_mem->id = id;
 	kobject_init(&sclp_mem->kobj, &ktype);
 	rc = kobject_add(&sclp_mem->kobj, &kset->kobj, "memory%d", id);
diff --git a/drivers/s390/char/sclp_sd.c b/drivers/s390/char/sclp_sd.c
index bb1bce70ec00..e4a90a14028a 100644
--- a/drivers/s390/char/sclp_sd.c
+++ b/drivers/s390/char/sclp_sd.c
@@ -16,8 +16,7 @@
 #include <linux/vmalloc.h>
 #include <linux/async.h>
 #include <linux/mutex.h>
-
-#include <asm/pgalloc.h>
+#include <linux/pgalloc.h>
 
 #include "sclp.h"
 
diff --git a/drivers/s390/char/vmur.c b/drivers/s390/char/vmur.c
index e3e0e9f36527..a226ff208eda 100644
--- a/drivers/s390/char/vmur.c
+++ b/drivers/s390/char/vmur.c
@@ -154,7 +154,7 @@ static struct urdev *urdev_get_from_devno(u16 devno)
 	struct ccw_device *cdev;
 	struct urdev *urd;
 
-	sprintf(bus_id, "0.0.%04x", devno);
+	scnprintf(bus_id, sizeof(bus_id), "0.0.%04x", devno);
 	cdev = get_ccwdev_by_busid(&ur_driver, bus_id);
 	if (!cdev)
 		return NULL;
@@ -904,11 +904,11 @@ static int ur_set_online(struct ccw_device *cdev)
 		goto fail_free_cdev;
 	if (urd->cdev->id.cu_type == READER_PUNCH_DEVTYPE) {
 		if (urd->class == DEV_CLASS_UR_I)
-			sprintf(node_id, "vmrdr-%s", dev_name(&cdev->dev));
+			scnprintf(node_id, sizeof(node_id), "vmrdr-%s", dev_name(&cdev->dev));
 		if (urd->class == DEV_CLASS_UR_O)
-			sprintf(node_id, "vmpun-%s", dev_name(&cdev->dev));
+			scnprintf(node_id, sizeof(node_id), "vmpun-%s", dev_name(&cdev->dev));
 	} else if (urd->cdev->id.cu_type == PRINTER_DEVTYPE) {
-		sprintf(node_id, "vmprt-%s", dev_name(&cdev->dev));
+		scnprintf(node_id, sizeof(node_id), "vmprt-%s", dev_name(&cdev->dev));
 	} else {
 		rc = -EOPNOTSUPP;
 		goto fail_free_cdev;