tracing: Use trace_seq_used() and seq_buf_used() instead of len
As the seq_buf->len will soon be +1 size when there's an overflow, we must use trace_seq_used() or seq_buf_used() methods to get the real length. This will prevent buffer overflow issues if just the len of the seq_buf descriptor is used to copy memory. Link: http://lkml.kernel.org/r/20141114121911.09ba3d38@gandalf.local.home Reported-by: Petr Mladek <pmladek@suse.cz> Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
This commit is contained in:

committed by
Steven Rostedt

parent
74f06bb723
commit
5ac4837841
@@ -944,10 +944,10 @@ static ssize_t trace_seq_to_buffer(struct trace_seq *s, void *buf, size_t cnt)
|
||||
{
|
||||
int len;
|
||||
|
||||
if (s->seq.len <= s->seq.readpos)
|
||||
if (trace_seq_used(s) <= s->seq.readpos)
|
||||
return -EBUSY;
|
||||
|
||||
len = s->seq.len - s->seq.readpos;
|
||||
len = trace_seq_used(s) - s->seq.readpos;
|
||||
if (cnt > len)
|
||||
cnt = len;
|
||||
memcpy(buf, s->buffer + s->seq.readpos, cnt);
|
||||
@@ -4514,18 +4514,18 @@ waitagain:
|
||||
trace_access_lock(iter->cpu_file);
|
||||
while (trace_find_next_entry_inc(iter) != NULL) {
|
||||
enum print_line_t ret;
|
||||
int len = iter->seq.seq.len;
|
||||
int save_len = iter->seq.seq.len;
|
||||
|
||||
ret = print_trace_line(iter);
|
||||
if (ret == TRACE_TYPE_PARTIAL_LINE) {
|
||||
/* don't print partial lines */
|
||||
iter->seq.seq.len = len;
|
||||
iter->seq.seq.len = save_len;
|
||||
break;
|
||||
}
|
||||
if (ret != TRACE_TYPE_NO_CONSUME)
|
||||
trace_consume(iter);
|
||||
|
||||
if (iter->seq.seq.len >= cnt)
|
||||
if (trace_seq_used(&iter->seq) >= cnt)
|
||||
break;
|
||||
|
||||
/*
|
||||
@@ -4541,7 +4541,7 @@ waitagain:
|
||||
|
||||
/* Now copy what we have to the user */
|
||||
sret = trace_seq_to_user(&iter->seq, ubuf, cnt);
|
||||
if (iter->seq.seq.readpos >= iter->seq.seq.len)
|
||||
if (iter->seq.seq.readpos >= trace_seq_used(&iter->seq))
|
||||
trace_seq_init(&iter->seq);
|
||||
|
||||
/*
|
||||
@@ -4598,7 +4598,7 @@ tracing_fill_pipe_page(size_t rem, struct trace_iterator *iter)
|
||||
break;
|
||||
}
|
||||
|
||||
count = iter->seq.seq.len - save_len;
|
||||
count = trace_seq_used(&iter->seq) - save_len;
|
||||
if (rem < count) {
|
||||
rem = 0;
|
||||
iter->seq.seq.len = save_len;
|
||||
@@ -4682,13 +4682,13 @@ static ssize_t tracing_splice_read_pipe(struct file *filp,
|
||||
/* Copy the data into the page, so we can start over. */
|
||||
ret = trace_seq_to_buffer(&iter->seq,
|
||||
page_address(spd.pages[i]),
|
||||
iter->seq.seq.len);
|
||||
trace_seq_used(&iter->seq));
|
||||
if (ret < 0) {
|
||||
__free_page(spd.pages[i]);
|
||||
break;
|
||||
}
|
||||
spd.partial[i].offset = 0;
|
||||
spd.partial[i].len = iter->seq.seq.len;
|
||||
spd.partial[i].len = trace_seq_used(&iter->seq);
|
||||
|
||||
trace_seq_init(&iter->seq);
|
||||
}
|
||||
@@ -5689,7 +5689,8 @@ tracing_stats_read(struct file *filp, char __user *ubuf,
|
||||
cnt = ring_buffer_read_events_cpu(trace_buf->buffer, cpu);
|
||||
trace_seq_printf(s, "read events: %ld\n", cnt);
|
||||
|
||||
count = simple_read_from_buffer(ubuf, count, ppos, s->buffer, s->seq.len);
|
||||
count = simple_read_from_buffer(ubuf, count, ppos,
|
||||
s->buffer, trace_seq_used(s));
|
||||
|
||||
kfree(s);
|
||||
|
||||
|
Reference in New Issue
Block a user