tracing: probeevent: Correctly update remaining space in dynamic area

rupran · rostedt · commit f6675872db57 · 2019-02-11T15:58:30.000-05:00
Commit 9178412 ("tracing: probeevent: Return consumed bytes of dynamic area") improved the string fetching mechanism by returning the number of required bytes after copying the argument to the dynamic area. However, this return value is now only used to increment the pointer inside the dynamic area but misses updating the 'maxlen' variable which indicates the remaining space in the dynamic area. This means that fetch_store_string() always reads the *total* size of the dynamic area from the data_loc pointer instead of the *remaining* size (and passes it along to strncpy_from_{user,unsafe}) even if we're already about to copy data into the middle of the dynamic area. Link: http://lkml.kernel.org/r/20190206190013.16405-1-andreas.ziegler@fau.de Cc: Ingo Molnar <mingo@redhat.com> Cc: stable@vger.kernel.org Fixes: 9178412 ("tracing: probeevent: Return consumed bytes of dynamic area") Acked-by: Masami Hiramatsu <mhiramat@kernel.org> Signed-off-by: Andreas Ziegler <andreas.ziegler@fau.de> Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
diff --git a/kernel/trace/trace_probe_tmpl.h b/kernel/trace/trace_probe_tmpl.h
@@ -180,10 +180,12 @@ store_trace_args(void *data, struct trace_probe *tp, struct pt_regs *regs,
 		if (unlikely(arg->dynamic))
 			*dl = make_data_loc(maxlen, dyndata - base);
 		ret = process_fetch_insn(arg->code, regs, dl, base);
-		if (unlikely(ret < 0 && arg->dynamic))
+		if (unlikely(ret < 0 && arg->dynamic)) {
 			*dl = make_data_loc(0, dyndata - base);
-		else
+		} else {
 			dyndata += ret;
+			maxlen -= ret;
+		}
 	}
 }
 

Original file line number	Diff line number	Diff line change
`@@ -180,10 +180,12 @@ store_trace_args(void data, struct trace_probe tp, struct pt_regs *regs,`
`180`	`180`	`if (unlikely(arg->dynamic))`
`181`	`181`	`*dl = make_data_loc(maxlen, dyndata - base);`
`182`	`182`	`ret = process_fetch_insn(arg->code, regs, dl, base);`
`183`		`- if (unlikely(ret < 0 && arg->dynamic))`
	`183`	`+ if (unlikely(ret < 0 && arg->dynamic)) {`
`184`	`184`	`*dl = make_data_loc(0, dyndata - base);`
`185`		`- else`
	`185`	`+ } else {`
`186`	`186`	`dyndata += ret;`
	`187`	`+ maxlen -= ret;`
	`188`	`+ }`
`187`	`189`	`}`
`188`	`190`	`}`
`189`	`191`