From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, Wen Gong <wgong@codeaurora.org>,
"Steven Rostedt (VMware)" <rostedt@goodmis.org>
Subject: [PATCH 4.19 02/50] tracing: Check length before giving out the filter buffer
Date: Mon, 22 Feb 2021 13:12:53 +0100 [thread overview]
Message-ID: <20210222121020.966943359@linuxfoundation.org> (raw)
In-Reply-To: <20210222121019.925481519@linuxfoundation.org>
From: Steven Rostedt (VMware) <rostedt@goodmis.org>
commit b220c049d5196dd94d992dd2dc8cba1a5e6123bf upstream.
When filters are used by trace events, a page is allocated on each CPU and
used to copy the trace event fields to this page before writing to the ring
buffer. The reason to use the filter and not write directly into the ring
buffer is because a filter may discard the event and there's more overhead
on discarding from the ring buffer than the extra copy.
The problem here is that there is no check against the size being allocated
when using this page. If an event asks for more than a page size while being
filtered, it will get only a page, leading to the caller writing more that
what was allocated.
Check the length of the request, and if it is more than PAGE_SIZE minus the
header default back to allocating from the ring buffer directly. The ring
buffer may reject the event if its too big anyway, but it wont overflow.
Link: https://lore.kernel.org/ath10k/1612839593-2308-1-git-send-email-wgong@codeaurora.org/
Cc: stable@vger.kernel.org
Fixes: 0fc1b09ff1ff4 ("tracing: Use temp buffer when filtering events")
Reported-by: Wen Gong <wgong@codeaurora.org>
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/trace/trace.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/kernel/trace/trace.c
+++ b/kernel/trace/trace.c
@@ -2292,7 +2292,7 @@ trace_event_buffer_lock_reserve(struct r
(entry = this_cpu_read(trace_buffered_event))) {
/* Try to use the per cpu buffer first */
val = this_cpu_inc_return(trace_buffered_event_cnt);
- if (val == 1) {
+ if ((len < (PAGE_SIZE - sizeof(*entry))) && val == 1) {
trace_event_setup(entry, type, flags, pc);
entry->array[0] = len;
return entry;
next prev parent reply other threads:[~2021-02-22 12:48 UTC|newest]
Thread overview: 56+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-02-22 12:12 [PATCH 4.19 00/50] 4.19.177-rc1 review Greg Kroah-Hartman
2021-02-22 12:12 ` [PATCH 4.19 01/50] tracing: Do not count ftrace events in top level enable output Greg Kroah-Hartman
2021-02-22 12:12 ` Greg Kroah-Hartman [this message]
2021-02-22 12:12 ` [PATCH 4.19 03/50] arm/xen: Dont probe xenbus as part of an early initcall Greg Kroah-Hartman
2021-02-22 12:12 ` [PATCH 4.19 04/50] arm64: dts: rockchip: Fix PCIe DT properties on rk3399 Greg Kroah-Hartman
2021-02-22 12:12 ` [PATCH 4.19 05/50] platform/x86: hp-wmi: Disable tablet-mode reporting by default Greg Kroah-Hartman
2021-02-22 12:12 ` [PATCH 4.19 06/50] ovl: perform vfs_getxattr() with mounter creds Greg Kroah-Hartman
2021-02-22 12:12 ` [PATCH 4.19 07/50] cap: fix conversions on getxattr Greg Kroah-Hartman
2021-02-22 12:12 ` [PATCH 4.19 08/50] ovl: skip getxattr of security labels Greg Kroah-Hartman
2021-02-22 12:13 ` [PATCH 4.19 09/50] drm/amd/display: Fix dc_sink kref count in emulated_link_detect Greg Kroah-Hartman
2021-02-22 12:13 ` [PATCH 4.19 10/50] drm/amd/display: Free atomic state after drm_atomic_commit Greg Kroah-Hartman
2021-02-22 12:13 ` [PATCH 4.19 11/50] riscv: virt_addr_valid must check the address belongs to linear mapping Greg Kroah-Hartman
2021-02-22 12:13 ` [PATCH 4.19 12/50] bfq-iosched: Revert "bfq: Fix computation of shallow depth" Greg Kroah-Hartman
2021-02-22 12:13 ` [PATCH 4.19 13/50] ARM: dts: lpc32xx: Revert set default clock rate of HCLK PLL Greg Kroah-Hartman
2021-02-22 12:13 ` [PATCH 4.19 14/50] ARM: ensure the signal page contains defined contents Greg Kroah-Hartman
2021-02-22 12:13 ` [PATCH 4.19 15/50] ARM: kexec: fix oops after TLB are invalidated Greg Kroah-Hartman
2021-02-22 12:13 ` [PATCH 4.19 16/50] mt76: dma: fix a possible memory leak in mt76_add_fragment() Greg Kroah-Hartman
2021-02-22 12:13 ` [PATCH 4.19 17/50] bpf: Check for integer overflow when using roundup_pow_of_two() Greg Kroah-Hartman
2021-02-22 12:13 ` [PATCH 4.19 18/50] netfilter: xt_recent: Fix attempt to update deleted entry Greg Kroah-Hartman
2021-02-22 12:13 ` [PATCH 4.19 19/50] netfilter: flowtable: fix tcp and udp header checksum update Greg Kroah-Hartman
2021-02-22 12:13 ` [PATCH 4.19 20/50] xen/netback: avoid race in xenvif_rx_ring_slots_available() Greg Kroah-Hartman
2021-02-22 12:13 ` [PATCH 4.19 21/50] net: stmmac: set TxQ mode back to DCB after disabling CBS Greg Kroah-Hartman
2021-02-22 12:13 ` [PATCH 4.19 22/50] netfilter: conntrack: skip identical origin tuple in same zone only Greg Kroah-Hartman
2021-02-22 12:13 ` [PATCH 4.19 23/50] net: hns3: add a check for queue_id in hclge_reset_vf_queue() Greg Kroah-Hartman
2021-02-22 12:13 ` [PATCH 4.19 24/50] firmware_loader: align .builtin_fw to 8 Greg Kroah-Hartman
2021-02-22 12:13 ` [PATCH 4.19 25/50] i2c: stm32f7: fix configuration of the digital filter Greg Kroah-Hartman
2021-02-22 12:13 ` [PATCH 4.19 26/50] h8300: fix PREEMPTION build, TI_PRE_COUNT undefined Greg Kroah-Hartman
2021-02-22 12:13 ` [PATCH 4.19 27/50] usb: dwc3: ulpi: fix checkpatch warning Greg Kroah-Hartman
2021-02-22 12:13 ` [PATCH 4.19 28/50] usb: dwc3: ulpi: Replace CPU-based busyloop with Protocol-based one Greg Kroah-Hartman
2021-02-22 12:13 ` [PATCH 4.19 29/50] net: fix iteration for sctp transport seq_files Greg Kroah-Hartman
2021-02-22 12:13 ` [PATCH 4.19 30/50] net/vmw_vsock: improve locking in vsock_connect_timeout() Greg Kroah-Hartman
2021-02-22 12:13 ` [PATCH 4.19 31/50] net: watchdog: hold device global xmit lock during tx disable Greg Kroah-Hartman
2021-02-22 12:13 ` [PATCH 4.19 32/50] vsock/virtio: update credit only if socket is not closed Greg Kroah-Hartman
2021-02-22 12:13 ` [PATCH 4.19 33/50] vsock: fix locking in vsock_shutdown() Greg Kroah-Hartman
2021-02-22 12:13 ` [PATCH 4.19 34/50] net/rds: restrict iovecs length for RDS_CMSG_RDMA_ARGS Greg Kroah-Hartman
2021-02-22 12:13 ` [PATCH 4.19 35/50] net/qrtr: restrict user-controlled length in qrtr_tun_write_iter() Greg Kroah-Hartman
2021-02-22 12:13 ` [PATCH 4.19 36/50] ovl: expand warning in ovl_d_real() Greg Kroah-Hartman
2021-02-22 12:13 ` [PATCH 4.19 37/50] x86/build: Disable CET instrumentation in the kernel for 32-bit too Greg Kroah-Hartman
2021-02-22 12:13 ` [PATCH 4.19 38/50] KVM: SEV: fix double locking due to incorrect backport Greg Kroah-Hartman
2021-02-22 12:13 ` [PATCH 4.19 39/50] net: qrtr: Fix port ID for control messages Greg Kroah-Hartman
2021-02-22 12:13 ` [PATCH 4.19 40/50] Xen/x86: dont bail early from clear_foreign_p2m_mapping() Greg Kroah-Hartman
2021-02-22 12:13 ` [PATCH 4.19 41/50] Xen/x86: also check kernel mapping in set_foreign_p2m_mapping() Greg Kroah-Hartman
2021-02-22 12:13 ` [PATCH 4.19 42/50] Xen/gntdev: correct dev_bus_addr handling in gntdev_map_grant_pages() Greg Kroah-Hartman
2021-02-22 12:13 ` [PATCH 4.19 43/50] Xen/gntdev: correct error checking " Greg Kroah-Hartman
2021-02-22 12:13 ` [PATCH 4.19 44/50] xen/arm: dont ignore return errors from set_phys_to_machine Greg Kroah-Hartman
2021-02-22 12:13 ` [PATCH 4.19 45/50] xen-blkback: dont "handle" error by BUG() Greg Kroah-Hartman
2021-02-22 12:13 ` [PATCH 4.19 46/50] xen-netback: " Greg Kroah-Hartman
2021-02-22 12:13 ` [PATCH 4.19 47/50] xen-scsiback: " Greg Kroah-Hartman
2021-02-22 12:13 ` [PATCH 4.19 48/50] xen-blkback: fix error handling in xen_blkbk_map() Greg Kroah-Hartman
2021-02-22 12:13 ` [PATCH 4.19 49/50] scsi: qla2xxx: Fix crash during driver load on big endian machines Greg Kroah-Hartman
2021-02-22 12:13 ` [PATCH 4.19 50/50] kvm: check tlbs_dirty directly Greg Kroah-Hartman
2021-02-22 18:40 ` [PATCH 4.19 00/50] 4.19.177-rc1 review Pavel Machek
2021-02-22 21:28 ` Guenter Roeck
2021-02-22 21:49 ` Igor
2021-02-23 10:10 ` Naresh Kamboju
2021-02-23 21:17 ` Shuah Khan
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20210222121020.966943359@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=linux-kernel@vger.kernel.org \
--cc=rostedt@goodmis.org \
--cc=stable@vger.kernel.org \
--cc=wgong@codeaurora.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).