Skip to contentSkip to conversation

trace: fix potenial dangerous pointer

PATCH Steven Rostedt 3 participants 3 messages Nov 24, 2020 – Nov 25, 2020 1 message not in the archive

lore
Share & tools
lore

A message that is not in the archive (sent off-list or not yet received): 20201124165205.GA23937@rlk

Steven Rostedt

author Acked-by
#1 lore raw
Quoted 5 lines · On Wed, 25 Nov 2020 00:52:05 +0800 Hui Su <[email protected]> wrote:

The bdi_dev_name() returns a char [64], and
the __entry->name is a char [32].

It maybe dangerous to TP_printk("%s", __entry->name) after the strncpy().

Acked-by Steven Rostedt (VMware) <[email protected]>

This should go through the tree that has the code that uses these tracepoints.

-- Steve

Quoted 46 lines
Signed-off-by Hui Su <[email protected]>
---
 include/trace/events/writeback.h | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)
include/trace/events/writeback.h +4 -4
index e7cbccc7c14c..57d795365987 100644
@@ -190,7 +190,7 @@ TRACE_EVENT(inode_foreign_history,
 	),
 
 	TP_fast_assign(
-		strncpy(__entry->name, bdi_dev_name(inode_to_bdi(inode)), 32);
+		strscpy_pad(__entry->name, bdi_dev_name(inode_to_bdi(inode)), 32);
 		__entry->ino		= inode->i_ino;
 		__entry->cgroup_ino	= __trace_wbc_assign_cgroup(wbc);
 		__entry->history	= history;

@@ -219,7 +219,7 @@ TRACE_EVENT(inode_switch_wbs,
 	),
 
 	TP_fast_assign(
-		strncpy(__entry->name,	bdi_dev_name(old_wb->bdi), 32);
+		strscpy_pad(__entry->name, bdi_dev_name(old_wb->bdi), 32);
 		__entry->ino		= inode->i_ino;
 		__entry->old_cgroup_ino	= __trace_wb_assign_cgroup(old_wb);
 		__entry->new_cgroup_ino	= __trace_wb_assign_cgroup(new_wb);

@@ -252,7 +252,7 @@ TRACE_EVENT(track_foreign_dirty,
 		struct address_space *mapping = page_mapping(page);
 		struct inode *inode = mapping ? mapping->host : NULL;
 
-		strncpy(__entry->name,	bdi_dev_name(wb->bdi), 32);
+		strscpy_pad(__entry->name, bdi_dev_name(wb->bdi), 32);
 		__entry->bdi_id		= wb->bdi->id;
 		__entry->ino		= inode ? inode->i_ino : 0;
 		__entry->memcg_id	= wb->memcg_css->id;

@@ -285,7 +285,7 @@ TRACE_EVENT(flush_foreign,
 	),
 
 	TP_fast_assign(
-		strncpy(__entry->name,	bdi_dev_name(wb->bdi), 32);
+		strscpy_pad(__entry->name, bdi_dev_name(wb->bdi), 32);
 		__entry->cgroup_ino	= __trace_wb_assign_cgroup(wb);
 		__entry->frn_bdi_id	= frn_bdi_id;
 		__entry->frn_memcg_id	= frn_memcg_id;
Acked-by
#2 lore raw
Quoted 6 lines · Steven Rostedt
Quoted 3 lines · On Wed, 25 Nov 2020 00:52:05 +0800 Hui Su <[email protected]> wrote:

The bdi_dev_name() returns a char [64], and
the __entry->name is a char [32].

Quoted 7 lines
Quoted 2 lines

It maybe dangerous to TP_printk("%s", __entry->name) after the strncpy().

Acked-by Steven Rostedt (VMware) <[email protected]>

This should go through the tree that has the code that uses these tracepoints.

Acked-by Tejun Heo <[email protected]>

Andrew, can you please route this one?

Thanks.

Signature · 1 line
tejun
#3 lore raw
Quoted 10 lines · Tejun Heo
Quoted 9 lines · Steven Rostedt
Quoted 5 lines · On Wed, 25 Nov 2020 00:52:05 +0800 Hui Su <[email protected]> wrote:

The bdi_dev_name() returns a char [64], and
the __entry->name is a char [32].

It maybe dangerous to TP_printk("%s", __entry->name) after the strncpy().

Quoted 8 lines
Quoted 4 lines
Acked-by Steven Rostedt (VMware) <[email protected]>

This should go through the tree that has the code that uses these tracepoints.

Acked-by Tejun Heo <[email protected]>

Andrew, can you please route this one?

I'll queue it to my tree and push it to Linus on Friday since I sometimes handle writeback stuff myself anyway...

Honza

Signature · 2 lines
Jan Kara <[email protected]>
SUSE Labs, CR