Linux-Trace-Devel Archive on
 help / color / Atom feed
* [PATCH] trace-cmd split: Fix off-by-one error when calculating record len
@ 2021-06-29  2:26 Steven Rostedt
  0 siblings, 0 replies; only message in thread
From: Steven Rostedt @ 2021-06-29  2:26 UTC (permalink / raw)
  To: linux-trace-devel, Julia Lawall

From: "Steven Rostedt (VMware)" <>

When a record has 112 or fewer bytes (28 * 4) for size, it has a 4 byte
record that contains 5 bits for the size of the event divided by 4, and 27
bits for the time delta. (0, 29, 30 31 are special values for those 5

The split logic recreates the record header for each event it copies over
from the source trace file to the destination trace file. To decide the
header, it incorrectly checked for "less than" instead of "less than or
equal to" of size "28 * 4". This caused the copying of the event to add
the extended header.

The issue happened, because of the added 4 bytes, it ended up overwriting
the end of the page. The "\0" ended at the edge and was cut off.
(There should be a better check for this as well).

Fix the header check to use the compact header for 112 byte events.

Fixes: 87d2a344a ("trace-cmd: Add split feature")
Reported-by: Julia Lawall <>
Signed-off-by: Steven Rostedt (VMware) <>
 tracecmd/trace-split.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tracecmd/trace-split.c b/tracecmd/trace-split.c
index 233feb89..9b1a8d7a 100644
--- a/tracecmd/trace-split.c
+++ b/tracecmd/trace-split.c
@@ -106,7 +106,7 @@ static int write_record(struct tracecmd_input *handle,
 		return 0;
-	if (record->size && (record->size < 28 * 4))
+	if (record->size && (record->size <= 28 * 4))
 		len = record->size / 4;
 	time = (unsigned)diff;

^ permalink raw reply	[flat|nested] only message in thread

only message in thread, back to index

Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-06-29  2:26 [PATCH] trace-cmd split: Fix off-by-one error when calculating record len Steven Rostedt

Linux-Trace-Devel Archive on

Archives are clonable:
	git clone --mirror linux-trace-devel/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 linux-trace-devel linux-trace-devel/ \
	public-inbox-index linux-trace-devel

Example config snippet for mirrors

Newsgroup available over NNTP:

AGPL code for this site: git clone