Skip to contentSkip to conversation

Patch "tracing: Fix crash from reading trace_pipe with sendfile" has been added to the 4.5-stable tree

PATCH [email protected] 1 participant 1 message Apr 10, 2016

Subsystems (2)
lore
Share & tools
lore

[email protected]

author maintainer Applied
#0 lore raw

This is a note to let you know that I've just added the patch titled

tracing: Fix crash from reading trace_pipe with sendfile

to the 4.5-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
tracing-fix-crash-from-reading-trace_pipe-with-sendfile.patch
and it can be found in the queue-4.5 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

Quoted 1 line

From a29054d9478d0435ab01b7544da4f674ab13f533 Mon Sep 17 00:00:00 2001

From: "Steven Rostedt (Red Hat)" <[email protected]>
Date: Fri, 18 Mar 2016 15:46:48 -0400
Subject: tracing: Fix crash from reading trace_pipe with sendfile

From: Steven Rostedt (Red Hat) <[email protected]>

commit a29054d9478d0435ab01b7544da4f674ab13f533 upstream.

If tracing contains data and the trace_pipe file is read with sendfile(), then it can trigger a NULL pointer dereference and various BUG_ON within the VM code.

There's a patch to fix this in the splice_to_pipe() code, but it's also a good idea to not let that happen from trace_pipe either.

---
 kernel/trace/trace.c |    5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)
kernel/trace/trace.c +4 -1
@@ -4949,7 +4949,10 @@ static ssize_t tracing_splice_read_pipe(
 
 	spd.nr_pages = i;
 
-	ret = splice_to_pipe(pipe, &spd);
+	if (i)
+		ret = splice_to_pipe(pipe, &spd);
+	else
+		ret = 0;
 out:
 	splice_shrink_spd(&spd);
 	return ret;

Patches currently in stable-queue which might be from [email protected] are

queue-4.5/tracing-fix-trace_printk-to-print-when-not-using-bprintk.patch queue-4.5/tracing-fix-crash-from-reading-trace_pipe-with-sendfile.patch queue-4.5/tracing-have-preempt-irqs-off-trace-preempt-disabled-functions.patch