diff options
| author | Steven Rostedt (Red Hat) | 2014-11-14 21:49:41 +0100 |
|---|---|---|
| committer | Steven Rostedt | 2014-11-20 04:01:15 +0100 |
| commit | 5ac48378414dccca735897c4d7f4e19987c8977c (patch) | |
| tree | 9cf5c11dddd8081327d7e7f8a68a9e47613adcfa /kernel/trace/seq_buf.c | |
| parent | tracing: Clean up tracing_fill_pipe_page() (diff) | |
| download | kernel-qcow2-linux-5ac48378414dccca735897c4d7f4e19987c8977c.tar.gz kernel-qcow2-linux-5ac48378414dccca735897c4d7f4e19987c8977c.tar.xz kernel-qcow2-linux-5ac48378414dccca735897c4d7f4e19987c8977c.zip | |
tracing: Use trace_seq_used() and seq_buf_used() instead of len
As the seq_buf->len will soon be +1 size when there's an overflow, we
must use trace_seq_used() or seq_buf_used() methods to get the real
length. This will prevent buffer overflow issues if just the len
of the seq_buf descriptor is used to copy memory.
Link: http://lkml.kernel.org/r/20141114121911.09ba3d38@gandalf.local.home
Reported-by: Petr Mladek <pmladek@suse.cz>
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
Diffstat (limited to 'kernel/trace/seq_buf.c')
| -rw-r--r-- | kernel/trace/seq_buf.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/kernel/trace/seq_buf.c b/kernel/trace/seq_buf.c index 9ec5305d9da7..ce17f65268ed 100644 --- a/kernel/trace/seq_buf.c +++ b/kernel/trace/seq_buf.c @@ -328,7 +328,7 @@ int seq_buf_to_user(struct seq_buf *s, char __user *ubuf, int cnt) if (s->len <= s->readpos) return -EBUSY; - len = s->len - s->readpos; + len = seq_buf_used(s) - s->readpos; if (cnt > len) cnt = len; ret = copy_to_user(ubuf, s->buffer + s->readpos, cnt); |