tracing: Use trace_seq_used() and seq_buf_used() instead of len

As the seq_buf->len will soon be +1 size when there's an overflow, we
must use trace_seq_used() or seq_buf_used() methods to get the real
length. This will prevent buffer overflow issues if just the len
of the seq_buf descriptor is used to copy memory.

Link: http://lkml.kernel.org/r/20141114121911.09ba3d38@gandalf.local.home
Reported-by: Petr Mladek <pmladek@suse.cz>
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>

diff --git a/include/linux/trace_seq.h b/include/linux/trace_seq.h
index 85d37106be3d56354d7cba49212eee7390ef2f4e..cfaf5a1d4bad77cac2f76b41c9bc0fe4f7746ff2 100644 (file)
--- a/include/linux/trace_seq.h
+++ b/include/linux/trace_seq.h
@@ -23,6 +23,24 @@ trace_seq_init(struct trace_seq *s)
        s->full = 0;
 }
 
+/**
+ * trace_seq_used - amount of actual data written to buffer
+ * @s: trace sequence descriptor
+ *
+ * Returns the amount of data written to the buffer.
+ *
+ * IMPORTANT!
+ *
+ * Use this instead of @s->seq.len if you need to pass the amount
+ * of data from the buffer to another buffer (userspace, or what not).
+ * The @s->seq.len on overflow is bigger than the buffer size and
+ * using it can cause access to undefined memory.
+ */
+static inline int trace_seq_used(struct trace_seq *s)
+{
+       return seq_buf_used(&s->seq);
+}
+
 /**
  * trace_seq_buffer_ptr - return pointer to next location in buffer
  * @s: trace sequence descriptor
@@ -35,7 +53,7 @@ trace_seq_init(struct trace_seq *s)
 static inline unsigned char *
 trace_seq_buffer_ptr(struct trace_seq *s)
 {
-       return s->buffer + s->seq.len;
+       return s->buffer + seq_buf_used(&s->seq);
 }
 
 /**

diff --git a/kernel/trace/seq_buf.c b/kernel/trace/seq_buf.c
index 9ec5305d9da70bb764a3b911368510861090ade2..ce17f65268ed6011f13feb21408a03947de18872 100644 (file)
--- a/kernel/trace/seq_buf.c
+++ b/kernel/trace/seq_buf.c
@@ -328,7 +328,7 @@ int seq_buf_to_user(struct seq_buf *s, char __user *ubuf, int cnt)
        if (s->len <= s->readpos)
                return -EBUSY;
 
-       len = s->len - s->readpos;
+       len = seq_buf_used(s) - s->readpos;
        if (cnt > len)
                cnt = len;
        ret = copy_to_user(ubuf, s->buffer + s->readpos, cnt);

diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
index 0aa75be843a0b7329ce3bac1d27ffbb9f3ac2fb0..9023446b2c2bc1f37aacc6a4e47a71bbf7c66866 100644 (file)
--- a/kernel/trace/trace.c
+++ b/kernel/trace/trace.c
@@ -944,10 +944,10 @@ static ssize_t trace_seq_to_buffer(struct trace_seq *s, void *buf, size_t cnt)
 {
        int len;
 
-       if (s->seq.len <= s->seq.readpos)
+       if (trace_seq_used(s) <= s->seq.readpos)
                return -EBUSY;
 
-       len = s->seq.len - s->seq.readpos;
+       len = trace_seq_used(s) - s->seq.readpos;
        if (cnt > len)
                cnt = len;
        memcpy(buf, s->buffer + s->seq.readpos, cnt);
@@ -4514,18 +4514,18 @@ waitagain:
        trace_access_lock(iter->cpu_file);
        while (trace_find_next_entry_inc(iter) != NULL) {
                enum print_line_t ret;
-               int len = iter->seq.seq.len;
+               int save_len = iter->seq.seq.len;
 
                ret = print_trace_line(iter);
                if (ret == TRACE_TYPE_PARTIAL_LINE) {
                        /* don't print partial lines */
-                       iter->seq.seq.len = len;
+                       iter->seq.seq.len = save_len;
                        break;
                }
                if (ret != TRACE_TYPE_NO_CONSUME)
                        trace_consume(iter);
 
-               if (iter->seq.seq.len >= cnt)
+               if (trace_seq_used(&iter->seq) >= cnt)
                        break;
 
                /*
@@ -4541,7 +4541,7 @@ waitagain:
 
        /* Now copy what we have to the user */
        sret = trace_seq_to_user(&iter->seq, ubuf, cnt);
-       if (iter->seq.seq.readpos >= iter->seq.seq.len)
+       if (iter->seq.seq.readpos >= trace_seq_used(&iter->seq))
                trace_seq_init(&iter->seq);
 
        /*
@@ -4598,7 +4598,7 @@ tracing_fill_pipe_page(size_t rem, struct trace_iterator *iter)
                        break;
                }
 
-               count = iter->seq.seq.len - save_len;
+               count = trace_seq_used(&iter->seq) - save_len;
                if (rem < count) {
                        rem = 0;
                        iter->seq.seq.len = save_len;
@@ -4682,13 +4682,13 @@ static ssize_t tracing_splice_read_pipe(struct file *filp,
                /* Copy the data into the page, so we can start over. */
                ret = trace_seq_to_buffer(&iter->seq,
                                          page_address(spd.pages[i]),
-                                         iter->seq.seq.len);
+                                         trace_seq_used(&iter->seq));
                if (ret < 0) {
                        __free_page(spd.pages[i]);
                        break;
                }
                spd.partial[i].offset = 0;
-               spd.partial[i].len = iter->seq.seq.len;
+               spd.partial[i].len = trace_seq_used(&iter->seq);
 
                trace_seq_init(&iter->seq);
        }
@@ -5689,7 +5689,8 @@ tracing_stats_read(struct file *filp, char __user *ubuf,
        cnt = ring_buffer_read_events_cpu(trace_buf->buffer, cpu);
        trace_seq_printf(s, "read events: %ld\n", cnt);
 
-       count = simple_read_from_buffer(ubuf, count, ppos, s->buffer, s->seq.len);
+       count = simple_read_from_buffer(ubuf, count, ppos,
+                                       s->buffer, trace_seq_used(s));
 
        kfree(s);
 

diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c
index 4d0067dd7f88dcf0351a611dc89b6d5da73723fe..935cbea7853284f565a726df58413833436c8884 100644 (file)
--- a/kernel/trace/trace_events.c
+++ b/kernel/trace/trace_events.c
@@ -1044,7 +1044,8 @@ event_filter_read(struct file *filp, char __user *ubuf, size_t cnt,
        mutex_unlock(&event_mutex);
 
        if (file)
-               r = simple_read_from_buffer(ubuf, cnt, ppos, s->buffer, s->seq.len);
+               r = simple_read_from_buffer(ubuf, cnt, ppos,
+                                           s->buffer, trace_seq_used(s));
 
        kfree(s);
 
@@ -1210,7 +1211,8 @@ subsystem_filter_read(struct file *filp, char __user *ubuf, size_t cnt,
        trace_seq_init(s);
 
        print_subsystem_event_filter(system, s);
-       r = simple_read_from_buffer(ubuf, cnt, ppos, s->buffer, s->seq.len);
+       r = simple_read_from_buffer(ubuf, cnt, ppos,
+                                   s->buffer, trace_seq_used(s));
 
        kfree(s);
 
@@ -1265,7 +1267,8 @@ show_header(struct file *filp, char __user *ubuf, size_t cnt, loff_t *ppos)
        trace_seq_init(s);
 
        func(s);
-       r = simple_read_from_buffer(ubuf, cnt, ppos, s->buffer, s->seq.len);
+       r = simple_read_from_buffer(ubuf, cnt, ppos,
+                                   s->buffer, trace_seq_used(s));
 
        kfree(s);
 

diff --git a/kernel/trace/trace_functions_graph.c b/kernel/trace/trace_functions_graph.c
index 6d1342ae7a4489e4e7f15bed39621096409964b6..ec35468349a7aa217a719eda46e1c7b60b15efa4 100644 (file)
--- a/kernel/trace/trace_functions_graph.c
+++ b/kernel/trace/trace_functions_graph.c
@@ -1153,6 +1153,9 @@ print_graph_comment(struct trace_seq *s, struct trace_entry *ent,
                        return ret;
        }
 
+       if (trace_seq_has_overflowed(s))
+               goto out;
+
        /* Strip ending newline */
        if (s->buffer[s->seq.len - 1] == '\n') {
                s->buffer[s->seq.len - 1] = '\0';
@@ -1160,7 +1163,7 @@ print_graph_comment(struct trace_seq *s, struct trace_entry *ent,
        }
 
        trace_seq_puts(s, " */\n");
-
+ out:
        return trace_handle_return(s);
 }
 

diff --git a/kernel/trace/trace_seq.c b/kernel/trace/trace_seq.c
index 74cacc930c2424914caec2a83baf2bb771a9b0b4..f8b45d8792f96cd4f5b3cc8428d435da0c84f96a 100644 (file)
--- a/kernel/trace/trace_seq.c
+++ b/kernel/trace/trace_seq.c
@@ -30,7 +30,7 @@
 #define TRACE_SEQ_BUF_LEFT(s) seq_buf_buffer_left(&(s)->seq)
 
 /* How much buffer is written? */
-#define TRACE_SEQ_BUF_USED(s) min((s)->seq.len, (unsigned int)(PAGE_SIZE - 1))
+#define TRACE_SEQ_BUF_USED(s) seq_buf_used(&(s)->seq)
 
 /*
  * trace_seq should work with being initialized with 0s.