Merge tag 'trace-v5.16-5' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace

Pull tracing fix from Steven Rostedt: "Update to tracing histogram variable string copy A fix to only copy the size of the field to the histogram string did not take into account that the size can be larger than the storage" * tag 'trace-v5.16-5' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace: tracing: Add length protection to histogram string copies

Linus Torvalds committed 4 years ago

Commit 8ab77452 parents 158ea2d 938aa332 files · +8 −3Browse files

Unified · Split

2 files

include/linux/trace_events.h +1 −1
kernel/trace/trace_events_hist.c +7 −2

include/linux/trace_events.h+1−1

@@ -673,7 +673,7 @@ struct trace_event_file { · 672 unmodified lines
673	673
674	674	#define PERF_MAX_TRACE_SIZE 8192
675	675
676		−#define MAX_FILTER_STR_VAL 256 /* Should handle KSYM_SYMBOL_LEN */
	676	+#define MAX_FILTER_STR_VAL 256U /* Should handle KSYM_SYMBOL_LEN */
677	677
678	678	enum event_trigger_type {
679	679	ETT_NONE = (0),

kernel/trace/trace_events_hist.c+7−2

@@ -3026,8 +3026,10 @@ static inline void __update_field_vars(struct tracing_map_elt *elt, · 3025 unmodified lines
3026	3026	if (val->flags & HIST_FIELD_FL_STRING) {
3027	3027	char *str = elt_data->field_var_str[j++];
3028	3028	char val_str = (char )(uintptr_t)var_val;
	3029	+ unsigned int size;
3029	3030
3030		− strscpy(str, val_str, val->size);
	3031	+ size = min(val->size, STR_VAR_LEN_MAX);
	3032	+ strscpy(str, val_str, size);
3031	3033	var_val = (u64)(uintptr_t)str;
3032	3034	}
3033	3035	tracing_map_set_var(elt, var_idx, var_val);
@@ -4914,6 +4916,7 @@ static void hist_trigger_elt_update(struct hist_trigger_data *hist_data, · 1880 unmodified lines
4914	4916	if (hist_field->flags & HIST_FIELD_FL_STRING) {
4915	4917	unsigned int str_start, var_str_idx, idx;
4916	4918	char str, val_str;
	4919	+ unsigned int size;
4917	4920
4918	4921	str_start = hist_data->n_field_var_str +
4919	4922	hist_data->n_save_var_str;
@@ -4922,7 +4925,9 @@ static void hist_trigger_elt_update(struct hist_trigger_data *hist_data, · 2 unmodified lines
4922	4925
4923	4926	str = elt_data->field_var_str[idx];
4924	4927	val_str = (char *)(uintptr_t)hist_val;
4925		− strscpy(str, val_str, hist_field->size);
	4928	+
	4929	+ size = min(hist_field->size, STR_VAR_LEN_MAX);
	4930	+ strscpy(str, val_str, size);
4926	4931
4927	4932	hist_val = (u64)(uintptr_t)str;
4928	4933	}