| From fdeb17c70c9ecae655378761accf5a26a55a33cf Mon Sep 17 00:00:00 2001 |
| From: Hui Su <sh_def@163.com> |
| Date: Wed, 25 Nov 2020 00:52:05 +0800 |
| Subject: trace: fix potenial dangerous pointer |
| |
| From: Hui Su <sh_def@163.com> |
| |
| commit fdeb17c70c9ecae655378761accf5a26a55a33cf upstream. |
| |
| The bdi_dev_name() returns a char [64], and |
| the __entry->name is a char [32]. |
| |
| It maybe dangerous to TP_printk("%s", __entry->name) |
| after the strncpy(). |
| |
| CC: stable@vger.kernel.org |
| Link: https://lore.kernel.org/r/20201124165205.GA23937@rlk |
| Acked-by: Steven Rostedt (VMware) <rostedt@goodmis.org> |
| Acked-by: Tejun Heo <tj@kernel.org> |
| Signed-off-by: Hui Su <sh_def@163.com> |
| Signed-off-by: Jan Kara <jack@suse.cz> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| |
| --- |
| include/trace/events/writeback.h | 8 ++++---- |
| 1 file changed, 4 insertions(+), 4 deletions(-) |
| |
| --- a/include/trace/events/writeback.h |
| +++ b/include/trace/events/writeback.h |
| @@ -192,7 +192,7 @@ TRACE_EVENT(inode_foreign_history, |
| ), |
| |
| TP_fast_assign( |
| - strncpy(__entry->name, bdi_dev_name(inode_to_bdi(inode)), 32); |
| + strscpy_pad(__entry->name, bdi_dev_name(inode_to_bdi(inode)), 32); |
| __entry->ino = inode->i_ino; |
| __entry->cgroup_ino = __trace_wbc_assign_cgroup(wbc); |
| __entry->history = history; |
| @@ -221,7 +221,7 @@ TRACE_EVENT(inode_switch_wbs, |
| ), |
| |
| TP_fast_assign( |
| - strncpy(__entry->name, bdi_dev_name(old_wb->bdi), 32); |
| + strscpy_pad(__entry->name, bdi_dev_name(old_wb->bdi), 32); |
| __entry->ino = inode->i_ino; |
| __entry->old_cgroup_ino = __trace_wb_assign_cgroup(old_wb); |
| __entry->new_cgroup_ino = __trace_wb_assign_cgroup(new_wb); |
| @@ -254,7 +254,7 @@ TRACE_EVENT(track_foreign_dirty, |
| struct address_space *mapping = page_mapping(page); |
| struct inode *inode = mapping ? mapping->host : NULL; |
| |
| - strncpy(__entry->name, bdi_dev_name(wb->bdi), 32); |
| + strscpy_pad(__entry->name, bdi_dev_name(wb->bdi), 32); |
| __entry->bdi_id = wb->bdi->id; |
| __entry->ino = inode ? inode->i_ino : 0; |
| __entry->memcg_id = wb->memcg_css->id; |
| @@ -287,7 +287,7 @@ TRACE_EVENT(flush_foreign, |
| ), |
| |
| TP_fast_assign( |
| - strncpy(__entry->name, bdi_dev_name(wb->bdi), 32); |
| + strscpy_pad(__entry->name, bdi_dev_name(wb->bdi), 32); |
| __entry->cgroup_ino = __trace_wb_assign_cgroup(wb); |
| __entry->frn_bdi_id = frn_bdi_id; |
| __entry->frn_memcg_id = frn_memcg_id; |