Commit 3a3089ec authored Jan 05, 2023 by Yang Jihong Committed by Yongqiang Liu Jan 05, 2023

tracing: Fix infinite loop in tracing_read_pipe on overflowed print_trace_line

mainline inclusion
from mainline-v6.2-rc1
commit c1ac03af
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I69283
CVE: NA

--------------------------------

print_trace_line may overflow seq_file buffer. If the event is not
consumed, the while loop keeps peeking this event, causing a infinite loop.

Link: https://lkml.kernel.org/r/20221129113009.182425-1-yangjihong1@huawei.com



Cc: Masami Hiramatsu <mhiramat@kernel.org>
Cc: stable@vger.kernel.org
Fixes: 088b1e42 ("ftrace: pipe fixes")
Signed-off-by: Yang Jihong <yangjihong1@huawei.com>
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
Signed-off-by: Yang Jihong <yangjihong1@huawei.com>
Reviewed-by: Zheng Yejian <zhengyejian1@huawei.com>
Reviewed-by: Ye Weihua <yeweihua4@huawei.com>
Signed-off-by: Yongqiang Liu <liuyongqiang13@huawei.com>

parent 85460c6b

kernel/trace/trace.c

+14 −1

Original line number	Original line	Diff line number	Diff line
	@@ -5771,7 +5771,20 @@ tracing_read_pipe(struct file filp, char __user ubuf,

	ret = print_trace_line(iter);		ret = print_trace_line(iter);
	if (ret == TRACE_TYPE_PARTIAL_LINE) {		if (ret == TRACE_TYPE_PARTIAL_LINE) {
	/* don't print partial lines */		/*
			* If one print_trace_line() fills entire trace_seq in one shot,
			* trace_seq_to_user() will returns -EBUSY because save_len == 0,
			* In this case, we need to consume it, otherwise, loop will peek
			* this event next time, resulting in an infinite loop.
			*/
			if (save_len == 0) {
			iter->seq.full = 0;
			trace_seq_puts(&iter->seq, "[LINE TOO BIG]\n");
			trace_consume(iter);
			break;
			}

			/* In other cases, don't print partial lines */
	iter->seq.seq.len = save_len;		iter->seq.seq.len = save_len;
	break;		break;
	}		}