lk/linux-kernel-test
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

blktrace: NUL-terminate user space messages

Browse Source 
Impact: fix corrupted blkparse output

Make sure messages from user space are NUL-terminated strings,
otherwise we could dump random memory to the block trace file.

Additionally, I've limited the message to BLK_TN_MAX_MSG-1
characters, because the last character would be stripped by
vscnprintf anyway.

Signed-off-by: Carl Henrik Lunde <chlunde@ping.uio.no>
Cc: Li Zefan <lizf@cn.fujitsu.com>
Cc: Arnaldo Carvalho de Melo <acme@redhat.com>
Cc: "Alan D. Brunelle" <alan.brunelle@hp.com>
Cc: Steven Rostedt <rostedt@goodmis.org>
LKML-Reference: <20090403122714.GT5178@kernel.dk>
Signed-off-by: Ingo Molnar <mingo@elte.hu>
This commit is contained in:
Carl Henrik Lunde
2009-04-03 14:27:15 +02:00
committed by Ingo Molnar
parent 18cea4591a
commit a4b3ada83d
1 changed files with 3 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
kernel/trace/blktrace.c
View File

@@ -327,10 +327,10 @@ static ssize_t blk_msg_write(struct file *filp, const char __user *buffer,
char *msg; char *msg;
struct blk_trace *bt; struct blk_trace *bt;
if (count > BLK_TN_MAX_MSG) if (count > BLK_TN_MAX_MSG - 1)
return -EINVAL; return -EINVAL;
msg = kmalloc(count, GFP_KERNEL); msg = kmalloc(count + 1, GFP_KERNEL);
if (msg == NULL) if (msg == NULL)
return -ENOMEM; return -ENOMEM;
@@ -339,6 +339,7 @@ static ssize_t blk_msg_write(struct file *filp, const char __user *buffer,
return -EFAULT; return -EFAULT;
} }
msg[count] = '\0';
bt = filp->private_data; bt = filp->private_data;
__trace_note_message(bt, "%s", msg); __trace_note_message(bt, "%s", msg);
kfree(msg); kfree(msg);