Commit 25a12987 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'trace-v5.13-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace 

Pull tracing fix from Steven Rostedt:
 "Fix trace_check_vprintf() for %.*s

  The sanity check of all strings being read from the ring buffer to
  make sure they are in safe memory space did not account for the %.*s
  notation having another parameter to process (the length).

  Add that to the check"

* tag 'trace-v5.13-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace:
  tracing: Handle %.*s in trace_check_vprintf()
parents bd3c9cdb eb01f535

kernel/trace/trace.c

+27 −4
Original line number Diff line number Diff line
@@ -3704,6 +3704,9 @@ void trace_check_vprintf(struct trace_iterator *iter, const char *fmt, 
		goto print;



	while (*p) {

		bool star = false;

		int len = 0;



		j = 0;



		/* We only care about %s and variants */
@@ -3725,13 +3728,17 @@ void trace_check_vprintf(struct trace_iterator *iter, const char *fmt, 
				/* Need to test cases like %08.*s */

				for (j = 1; p[i+j]; j++) {

					if (isdigit(p[i+j]) ||

					    p[i+j] == '*' ||

					    p[i+j] == '.')

						continue;

					if (p[i+j] == '*') {

						star = true;

						continue;

					}

					break;

				}

				if (p[i+j] == 's')

					break;

				star = false;

			}

			j = 0;

		}
@@ -3744,6 +3751,9 @@ void trace_check_vprintf(struct trace_iterator *iter, const char *fmt, 
		iter->fmt[i] = '\0';

		trace_seq_vprintf(&iter->seq, iter->fmt, ap);



		if (star)

			len = va_arg(ap, int);



		/* The ap now points to the string data of the %s */

		str = va_arg(ap, const char *);
@@ -3762,8 +3772,18 @@ void trace_check_vprintf(struct trace_iterator *iter, const char *fmt, 
			int ret;



			/* Try to safely read the string */

			if (star) {

				if (len + 1 > iter->fmt_size)

					len = iter->fmt_size - 1;

				if (len < 0)

					len = 0;

				ret = copy_from_kernel_nofault(iter->fmt, str, len);

				iter->fmt[len] = 0;

				star = false;

			} else {

				ret = strncpy_from_kernel_nofault(iter->fmt, str,

								  iter->fmt_size);

			}

			if (ret < 0)

				trace_seq_printf(&iter->seq, "(0x%px)", str);

			else
@@ -3775,6 +3795,9 @@ void trace_check_vprintf(struct trace_iterator *iter, const char *fmt, 
			strncpy(iter->fmt, p + i, j + 1);

			iter->fmt[j+1] = '\0';

		}

		if (star)

			trace_seq_printf(&iter->seq, iter->fmt, len, str);

		else

			trace_seq_printf(&iter->seq, iter->fmt, str);



		p += i + j + 1;