From: Steven Rostedt <rostedt@goodmis.org>
To: "linux-trace-devel@vger.kernel.org"
<linux-trace-devel@vger.kernel.org>,
Julia Lawall <julia.lawall@inria.fr>
Subject: [PATCH] trace-cmd split: Assert if the calculated record size is too big
Date: Mon, 28 Jun 2021 22:40:42 -0400 [thread overview]
Message-ID: <20210628224042.0ecc2030@oasis.local.home> (raw)
From: "Steven Rostedt (VMware)" <rostedt@goodmis.org>
With a discovery of a bug that caused a record to be written passed the
end of a page (and this was a possible memory corruption bug), check that
the calculated length is no bigger than the record it is copying. If it
is, then crash, as this can cause the data to write pass the allocated
page.
Now that bug would crash on the split command with:
Bad calculation of record len (expect:116 actual:120)
Link: https://lore.kernel.org/linux-trace-devel/20210628222609.01ea12ad@oasis.local.home/
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
---
tracecmd/trace-split.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/tracecmd/trace-split.c b/tracecmd/trace-split.c
index 9b1a8d7a..775611c1 100644
--- a/tracecmd/trace-split.c
+++ b/tracecmd/trace-split.c
@@ -118,6 +118,9 @@ static int write_record(struct tracecmd_input *handle,
if (!len) {
len = record->size + 4;
+ if ((len + 4) > record->record_size)
+ die("Bad calculation of record len (expect:%d actual:%d)",
+ record->record_size, len + 4);
*(unsigned *)ptr = tep_read_number(pevent, &len, 4);
ptr += 4;
index += 4;
--
2.29.2
reply other threads:[~2021-06-29 2:40 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20210628224042.0ecc2030@oasis.local.home \
--to=rostedt@goodmis.org \
--cc=julia.lawall@inria.fr \
--cc=linux-trace-devel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).