Pull tracing fix from Steven Rostedt: "Update to tracing histogram variable string copy A fix to only copy the size of the field to the histogram string did not take into account that the size can be larger than the storage" * tag 'trace-v5.16-5' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace: tracing: Add length protection to histogram string copies
Showing the changes to kernel/trace (1 of 2 files). Show all
Unified · Split
| @@ -3026,8 +3026,10 @@ static inline void __update_field_vars(struct tracing_map_elt *elt, · 3025 unmodified lines | |||
| 3026 | if (val->flags & HIST_FIELD_FL_STRING) { | 3026 | if (val->flags & HIST_FIELD_FL_STRING) { |
| 3027 | char *str = elt_data->field_var_str[j++]; | 3027 | char *str = elt_data->field_var_str[j++]; |
| 3028 | char *val_str = (char *)(uintptr_t)var_val; | 3028 | char *val_str = (char *)(uintptr_t)var_val; |
| 3029 | unsigned int size; | ||
| 3029 | 3030 | ||
| 3030 | strscpy(str, val_str, val->size); | 3031 | size = min(val->size, STR_VAR_LEN_MAX); |
| 3032 | strscpy(str, val_str, size); | ||
| 3031 | var_val = (u64)(uintptr_t)str; | 3033 | var_val = (u64)(uintptr_t)str; |
| 3032 | } | 3034 | } |
| 3033 | tracing_map_set_var(elt, var_idx, var_val); | 3035 | tracing_map_set_var(elt, var_idx, var_val); |
| @@ -4914,6 +4916,7 @@ static void hist_trigger_elt_update(struct hist_trigger_data *hist_data, · 1880 unmodified lines | |||
| 4914 | if (hist_field->flags & HIST_FIELD_FL_STRING) { | 4916 | if (hist_field->flags & HIST_FIELD_FL_STRING) { |
| 4915 | unsigned int str_start, var_str_idx, idx; | 4917 | unsigned int str_start, var_str_idx, idx; |
| 4916 | char *str, *val_str; | 4918 | char *str, *val_str; |
| 4919 | unsigned int size; | ||
| 4917 | 4920 | ||
| 4918 | str_start = hist_data->n_field_var_str + | 4921 | str_start = hist_data->n_field_var_str + |
| 4919 | hist_data->n_save_var_str; | 4922 | hist_data->n_save_var_str; |
| @@ -4922,7 +4925,9 @@ static void hist_trigger_elt_update(struct hist_trigger_data *hist_data, · 2 unmodified lines | |||
| 4922 | 4925 | ||
| 4923 | str = elt_data->field_var_str[idx]; | 4926 | str = elt_data->field_var_str[idx]; |
| 4924 | val_str = (char *)(uintptr_t)hist_val; | 4927 | val_str = (char *)(uintptr_t)hist_val; |
| 4925 | strscpy(str, val_str, hist_field->size); | 4928 | |
| 4929 | size = min(hist_field->size, STR_VAR_LEN_MAX); | ||
| 4930 | strscpy(str, val_str, size); | ||
| 4926 | 4931 | ||
| 4927 | hist_val = (u64)(uintptr_t)str; | 4932 | hist_val = (u64)(uintptr_t)str; |
| 4928 | } | 4933 | } |