* [GIT PULL] tracing: Add length protection to histogram string copies
@ 2021-11-15 2:33 Steven Rostedt
2021-11-15 3:11 ` pr-tracker-bot
0 siblings, 1 reply; 2+ messages in thread
From: Steven Rostedt @ 2021-11-15 2:33 UTC (permalink / raw)
To: Linus Torvalds
Cc: LKML, Ingo Molnar, Andrew Morton, Tom Zanussi, Masami Hiramatsu
Linus,
Update to tracing histogram variable string copy
A fix to only copy the size of the field to the histogram string
did not take into account that the size can be larger than the
storage.
Please pull the latest trace-v5.16-5 tree, which can be found at:
git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace.git
trace-v5.16-5
Tag SHA1: db2ed9a1d3f9d93cb36d38110e6567c1bd8d1e9a
Head SHA1: 938aa33f14657c9ed9deea348b7d6f14b6d69cb7
Steven Rostedt (VMware) (1):
tracing: Add length protection to histogram string copies
----
include/linux/trace_events.h | 2 +-
kernel/trace/trace_events_hist.c | 9 +++++++--
2 files changed, 8 insertions(+), 3 deletions(-)
---------------------------
commit 938aa33f14657c9ed9deea348b7d6f14b6d69cb7
Author: Steven Rostedt (VMware) <rostedt@goodmis.org>
Date: Sun Nov 14 13:28:34 2021 -0500
tracing: Add length protection to histogram string copies
The string copies to the histogram storage has a max size of 256 bytes
(defined by MAX_FILTER_STR_VAL). Only the string size of the event field
needs to be copied to the event storage, but no more than what is in the
event storage. Although nothing should be bigger than 256 bytes, there's
no protection against overwriting of the storage if one day there is.
Copy no more than the destination size, and enforce it.
Also had to turn MAX_FILTER_STR_VAL into an unsigned int, to keep the
min() comparison of the string sizes of comparable types.
Link: https://lore.kernel.org/all/CAHk-=wjREUihCGrtRBwfX47y_KrLCGjiq3t6QtoNJpmVrAEb1w@mail.gmail.com/
Link: https://lkml.kernel.org/r/20211114132834.183429a4@rorschach.local.home
Cc: Ingo Molnar <mingo@kernel.org>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Tom Zanussi <zanussi@kernel.org>
Reported-by: Linus Torvalds <torvalds@linux-foundation.org>
Reviewed-by: Masami Hiramatsu <mhiramat@kernel.org>
Fixes: 63f84ae6b82b ("tracing/histogram: Do not copy the fixed-size char array field over the field size")
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
diff --git a/include/linux/trace_events.h b/include/linux/trace_events.h
index 50453b287615..2d167ac3452c 100644
--- a/include/linux/trace_events.h
+++ b/include/linux/trace_events.h
@@ -673,7 +673,7 @@ struct trace_event_file {
#define PERF_MAX_TRACE_SIZE 8192
-#define MAX_FILTER_STR_VAL 256 /* Should handle KSYM_SYMBOL_LEN */
+#define MAX_FILTER_STR_VAL 256U /* Should handle KSYM_SYMBOL_LEN */
enum event_trigger_type {
ETT_NONE = (0),
diff --git a/kernel/trace/trace_events_hist.c b/kernel/trace/trace_events_hist.c
index 1475d7347fe0..34afcaebd0e5 100644
--- a/kernel/trace/trace_events_hist.c
+++ b/kernel/trace/trace_events_hist.c
@@ -3026,8 +3026,10 @@ static inline void __update_field_vars(struct tracing_map_elt *elt,
if (val->flags & HIST_FIELD_FL_STRING) {
char *str = elt_data->field_var_str[j++];
char *val_str = (char *)(uintptr_t)var_val;
+ unsigned int size;
- strscpy(str, val_str, val->size);
+ size = min(val->size, STR_VAR_LEN_MAX);
+ strscpy(str, val_str, size);
var_val = (u64)(uintptr_t)str;
}
tracing_map_set_var(elt, var_idx, var_val);
@@ -4914,6 +4916,7 @@ static void hist_trigger_elt_update(struct hist_trigger_data *hist_data,
if (hist_field->flags & HIST_FIELD_FL_STRING) {
unsigned int str_start, var_str_idx, idx;
char *str, *val_str;
+ unsigned int size;
str_start = hist_data->n_field_var_str +
hist_data->n_save_var_str;
@@ -4922,7 +4925,9 @@ static void hist_trigger_elt_update(struct hist_trigger_data *hist_data,
str = elt_data->field_var_str[idx];
val_str = (char *)(uintptr_t)hist_val;
- strscpy(str, val_str, hist_field->size);
+
+ size = min(hist_field->size, STR_VAR_LEN_MAX);
+ strscpy(str, val_str, size);
hist_val = (u64)(uintptr_t)str;
}
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [GIT PULL] tracing: Add length protection to histogram string copies
2021-11-15 2:33 [GIT PULL] tracing: Add length protection to histogram string copies Steven Rostedt
@ 2021-11-15 3:11 ` pr-tracker-bot
0 siblings, 0 replies; 2+ messages in thread
From: pr-tracker-bot @ 2021-11-15 3:11 UTC (permalink / raw)
To: Steven Rostedt
Cc: Linus Torvalds, LKML, Ingo Molnar, Andrew Morton, Tom Zanussi,
Masami Hiramatsu
The pull request you sent on Sun, 14 Nov 2021 21:33:17 -0500:
> git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace.git trace-v5.16-5
has been merged into torvalds/linux.git:
https://git.kernel.org/torvalds/c/8ab774587903771821b59471cc723bba6d893942
Thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/prtracker.html
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2021-11-15 3:11 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-11-15 2:33 [GIT PULL] tracing: Add length protection to histogram string copies Steven Rostedt
2021-11-15 3:11 ` pr-tracker-bot
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).