[v3] tracing: Fix out of bounds write in get_trace_buf
diff mbox series

Message ID 20201029155714.3935-1-hqjagain@gmail.com
State Accepted
Commit c1acb4ac1a892cf08d27efcb964ad281728b0545
Headers show
Series
  • [v3] tracing: Fix out of bounds write in get_trace_buf
Related show

Commit Message

Qiujun Huang Oct. 29, 2020, 3:57 p.m. UTC
The subscript should be nesting - 1, as nesting had self-added.

Fixes: e2ace001176dc ("tracing: Choose static tp_printk buffer by explicit nesting count")
Signed-off-by: Qiujun Huang <hqjagain@gmail.com>
---
v3:
Modify the way of array reference instead.
v2:
Fix a typo in the title.
---
 kernel/trace/trace.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

Comments

Steven Rostedt Oct. 29, 2020, 6:30 p.m. UTC | #1
On Thu, 29 Oct 2020 23:57:14 +0800
Qiujun Huang <hqjagain@gmail.com> wrote:

> The subscript should be nesting - 1, as nesting had self-added.

Thanks Qiujun! I'll add this to my urgent queue, and mark it for stable.

I'll update the change log to state:

"The nesting count of trace_printk allows for 4 levels of nesting. The
nesting counter starts at zero and is incremented before being used to
retrieve the current context's buffer. But the index to the buffer uses the
nesting counter after it was incremented, and not its original number,
which in needs to do."

-- Steve

> 
> Fixes: e2ace001176dc ("tracing: Choose static tp_printk buffer by explicit nesting count")
> Signed-off-by: Qiujun Huang <hqjagain@gmail.com>
> ---
> v3:
> Modify the way of array reference instead.
> v2:
> Fix a typo in the title.
> ---
>  kernel/trace/trace.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
> index 528971714fc6..daa96215e294 100644
> --- a/kernel/trace/trace.c
> +++ b/kernel/trace/trace.c
> @@ -3132,7 +3132,7 @@ static char *get_trace_buf(void)
>  
>  	/* Interrupts must see nesting incremented before we use the buffer */
>  	barrier();
> -	return &buffer->buffer[buffer->nesting][0];
> +	return &buffer->buffer[buffer->nesting - 1][0];
>  }
>  
>  static void put_trace_buf(void)

Patch
diff mbox series

diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
index 528971714fc6..daa96215e294 100644
--- a/kernel/trace/trace.c
+++ b/kernel/trace/trace.c
@@ -3132,7 +3132,7 @@  static char *get_trace_buf(void)
 
 	/* Interrupts must see nesting incremented before we use the buffer */
 	barrier();
-	return &buffer->buffer[buffer->nesting][0];
+	return &buffer->buffer[buffer->nesting - 1][0];
 }
 
 static void put_trace_buf(void)